diff --git a/CLAUDE.md b/CLAUDE.md
index 38f9a2542..39b614885 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -38,6 +38,43 @@ npm run dev                     # vite dev server
 npm run build                   # production build
 ```
 
+## Browser Tests (Pest Browser Plugin)
+
+Uses `pestphp/pest-plugin-browser` with Laravel Dusk 8. New browser tests go in `tests/v4/Browser/`.
+
+```bash
+# Run all browser tests
+php artisan test --compact tests/v4/Browser/
+
+# Run a specific browser test file
+php artisan test --compact tests/v4/Browser/LoginTest.php
+
+# Run a specific test by name
+php artisan test --compact --filter='can login with valid credentials'
+```
+
+### Writing Browser Tests
+
+- Place new tests in `tests/v4/Browser/` — legacy Dusk tests in `tests/Browser/` should not be used as reference.
+- Use `RefreshDatabase` and seed required data (at minimum `InstanceSettings::create(['id' => 0])`) in `beforeEach`.
+- Key API: `visit()`, `fill(field, value)`, `click(text)`, `assertSee()`, `assertDontSee()`, `assertPathIs()`, `screenshot()`.
+- Always call `screenshot()` at the end of each test for debugging.
+- For authenticated tests, create a helper function that logs in via the UI:
+
+```php
+function loginAsRoot(): mixed
+{
+    return visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login');
+}
+```
+
+- See `tests/v4/Browser/LoginTest.php`, `tests/v4/Browser/DashboardTest.php`, and `tests/v4/Browser/RegistrationTest.php` for conventions.
+- Chrome driver runs on `localhost:4444`, app on `localhost:8000` (configured in `tests/DuskTestCase.php`).
+- Legacy Dusk macros in `app/Providers/DuskServiceProvider.php` use the old `type()`/`press()` API — do not mix with Pest Browser Plugin's `fill()`/`click()` API.
+
 ## Architecture
 
 ### Backend Structure (app/)
diff --git a/app/Console/Commands/Emails.php b/app/Console/Commands/Emails.php
index 43ba06804..02be98fc9 100644
--- a/app/Console/Commands/Emails.php
+++ b/app/Console/Commands/Emails.php
@@ -18,6 +18,7 @@ use Exception;
 use Illuminate\Console\Command;
 use Illuminate\Mail\Message;
 use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Str;
 use Mail;
 
 use function Laravel\Prompts\confirm;
diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index f3193e9f2..8c8006973 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -30,7 +30,6 @@ use Illuminate\Validation\Rule;
 use OpenApi\Attributes as OA;
 use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
-use Visus\Cuid2\Cuid2;
 
 class ApplicationsController extends Controller
 {
@@ -64,6 +63,10 @@ class ApplicationsController extends Controller
             $this->hideNestedServerSecrets($application);
         }
 
+        if ($application->is_shown_once ?? false) {
+            $application->makeHidden(['value', 'real_value']);
+        }
+
         return serializeApiResponse($application);
     }
 
@@ -1251,7 +1254,7 @@ class ApplicationsController extends Controller
             $application->isConfigurationChanged(true);
 
             if ($instantDeploy) {
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
 
                 $result = queue_application_deployment(
                     application: $application,
@@ -1490,7 +1493,7 @@ class ApplicationsController extends Controller
             $application->isConfigurationChanged(true);
 
             if ($instantDeploy) {
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
 
                 $result = queue_application_deployment(
                     application: $application,
@@ -1699,7 +1702,7 @@ class ApplicationsController extends Controller
             $application->isConfigurationChanged(true);
 
             if ($instantDeploy) {
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
 
                 $result = queue_application_deployment(
                     application: $application,
@@ -1745,7 +1748,7 @@ class ApplicationsController extends Controller
                 ], 422);
             }
             if (! $request->has('name')) {
-                $request->offsetSet('name', 'dockerfile-'.new Cuid2);
+                $request->offsetSet('name', 'dockerfile-'.new_public_id());
             }
 
             $return = $this->validateDataApplications($request, $server);
@@ -1819,7 +1822,7 @@ class ApplicationsController extends Controller
             $application->isConfigurationChanged(true);
 
             if ($instantDeploy) {
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
 
                 $result = queue_application_deployment(
                     application: $application,
@@ -1863,7 +1866,7 @@ class ApplicationsController extends Controller
                 ], 422);
             }
             if (! $request->has('name')) {
-                $request->offsetSet('name', 'docker-image-'.new Cuid2);
+                $request->offsetSet('name', 'docker-image-'.new_public_id());
             }
             $return = $this->validateDataApplications($request, $server);
             if ($return instanceof JsonResponse) {
@@ -1938,7 +1941,7 @@ class ApplicationsController extends Controller
             $application->isConfigurationChanged(true);
 
             if ($instantDeploy) {
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
 
                 $result = queue_application_deployment(
                     application: $application,
@@ -2736,7 +2739,7 @@ class ApplicationsController extends Controller
         ]);
 
         if ($instantDeploy) {
-            $deployment_uuid = new Cuid2;
+            $deployment_uuid = new_public_id();
 
             $result = queue_application_deployment(
                 application: $application,
@@ -3643,7 +3646,7 @@ class ApplicationsController extends Controller
 
         $this->authorize('deploy', $application);
 
-        $deployment_uuid = new Cuid2;
+        $deployment_uuid = new_public_id();
 
         $result = queue_application_deployment(
             application: $application,
@@ -3841,7 +3844,7 @@ class ApplicationsController extends Controller
 
         $this->authorize('deploy', $application);
 
-        $deployment_uuid = new Cuid2;
+        $deployment_uuid = new_public_id();
 
         $result = queue_application_deployment(
             application: $application,
diff --git a/app/Http/Controllers/Api/CloudProviderTokensController.php b/app/Http/Controllers/Api/CloudProviderTokensController.php
index 2d8589662..a6f196f13 100644
--- a/app/Http/Controllers/Api/CloudProviderTokensController.php
+++ b/app/Http/Controllers/Api/CloudProviderTokensController.php
@@ -182,6 +182,7 @@ class CloudProviderTokensController extends Controller
         if (is_null($token)) {
             return response()->json(['message' => 'Cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         return response()->json($this->removeSensitiveData($token));
     }
@@ -248,6 +249,7 @@ class CloudProviderTokensController extends Controller
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [CloudProviderToken::class]);
 
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
@@ -399,6 +401,7 @@ class CloudProviderTokensController extends Controller
         if (! $token) {
             return response()->json(['message' => 'Cloud provider token not found.'], 404);
         }
+        $this->authorize('update', $token);
 
         $token->update(array_intersect_key($body, array_flip($allowedFields)));
 
@@ -480,6 +483,7 @@ class CloudProviderTokensController extends Controller
         if (! $token) {
             return response()->json(['message' => 'Cloud provider token not found.'], 404);
         }
+        $this->authorize('delete', $token);
 
         if ($token->hasServers()) {
             return response()->json(['message' => 'Cannot delete token that is used by servers.'], 400);
@@ -550,9 +554,18 @@ class CloudProviderTokensController extends Controller
         if (! $cloudToken) {
             return response()->json(['message' => 'Cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $cloudToken);
 
         $validation = $this->validateProviderToken($cloudToken->provider, $cloudToken->token);
 
+        auditLog('api.cloud_token.validated', [
+            'team_id' => $teamId,
+            'cloud_token_uuid' => $cloudToken->uuid,
+            'cloud_token_name' => $cloudToken->name,
+            'provider' => $cloudToken->provider,
+            'valid' => $validation['valid'],
+        ]);
+
         return response()->json([
             'valid' => $validation['valid'],
             'message' => $validation['valid'] ? 'Token is valid.' : $validation['error'],
diff --git a/app/Http/Controllers/Api/DeployController.php b/app/Http/Controllers/Api/DeployController.php
index 7a049ae2b..da95556e8 100644
--- a/app/Http/Controllers/Api/DeployController.php
+++ b/app/Http/Controllers/Api/DeployController.php
@@ -15,7 +15,6 @@ use App\Models\Tag;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Http\Request;
 use OpenApi\Attributes as OA;
-use Visus\Cuid2\Cuid2;
 
 class DeployController extends Controller
 {
@@ -515,7 +514,7 @@ class DeployController extends Controller
                 if ($dockerTag !== null && $resource->build_pack !== 'dockerimage') {
                     return ['message' => 'docker_tag can only be used with Docker Image applications.', 'deployment_uuid' => null];
                 }
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
                 $result = queue_application_deployment(
                     application: $resource,
                     deployment_uuid: $deployment_uuid,
diff --git a/app/Http/Controllers/Api/GithubController.php b/app/Http/Controllers/Api/GithubController.php
index 651969b97..150743f99 100644
--- a/app/Http/Controllers/Api/GithubController.php
+++ b/app/Http/Controllers/Api/GithubController.php
@@ -183,6 +183,7 @@ class GithubController extends Controller
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [GithubApp::class]);
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
             return $return;
@@ -564,6 +565,7 @@ class GithubController extends Controller
             $githubApp = GithubApp::where('id', $github_app_id)
                 ->where('team_id', $teamId)
                 ->firstOrFail();
+            $this->authorize('update', $githubApp);
 
             // Define allowed fields for update
             $allowedFields = [
@@ -737,6 +739,7 @@ class GithubController extends Controller
             $githubApp = GithubApp::where('id', $github_app_id)
                 ->where('team_id', $teamId)
                 ->firstOrFail();
+            $this->authorize('delete', $githubApp);
 
             // Check if the GitHub app is being used by any applications
             if ($githubApp->applications->isNotEmpty()) {
diff --git a/app/Http/Controllers/Api/HetznerController.php b/app/Http/Controllers/Api/HetznerController.php
index 2f35ba576..1c9d6f9ef 100644
--- a/app/Http/Controllers/Api/HetznerController.php
+++ b/app/Http/Controllers/Api/HetznerController.php
@@ -116,6 +116,7 @@ class HetznerController extends Controller
         if (! $token) {
             return response()->json(['message' => 'Hetzner cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         try {
             $hetznerService = new HetznerService($token->token);
@@ -237,6 +238,7 @@ class HetznerController extends Controller
         if (! $token) {
             return response()->json(['message' => 'Hetzner cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         try {
             $hetznerService = new HetznerService($token->token);
@@ -336,6 +338,7 @@ class HetznerController extends Controller
         if (! $token) {
             return response()->json(['message' => 'Hetzner cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         try {
             $hetznerService = new HetznerService($token->token);
@@ -445,6 +448,7 @@ class HetznerController extends Controller
         if (! $token) {
             return response()->json(['message' => 'Hetzner cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         try {
             $hetznerService = new HetznerService($token->token);
@@ -550,6 +554,7 @@ class HetznerController extends Controller
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [Server::class]);
 
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
@@ -620,6 +625,7 @@ class HetznerController extends Controller
         if (! $token) {
             return response()->json(['message' => 'Hetzner cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         // Validate private key
         $privateKey = PrivateKey::whereTeamId($teamId)->whereUuid($request->private_key_uuid)->first();
diff --git a/app/Http/Controllers/Api/ProjectController.php b/app/Http/Controllers/Api/ProjectController.php
index 0e5f6e93b..92f19c7ae 100644
--- a/app/Http/Controllers/Api/ProjectController.php
+++ b/app/Http/Controllers/Api/ProjectController.php
@@ -97,6 +97,7 @@ class ProjectController extends Controller
         if (! $project) {
             return response()->json(['message' => 'Project not found.'], 404);
         }
+        $this->authorize('view', $project);
 
         $project->load(['environments']);
 
@@ -233,6 +234,7 @@ class ProjectController extends Controller
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [Project::class]);
 
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
@@ -385,6 +387,7 @@ class ProjectController extends Controller
         if (! $project) {
             return response()->json(['message' => 'Project not found.'], 404);
         }
+        $this->authorize('update', $project);
 
         $project->update($request->only($allowedFields));
 
@@ -469,6 +472,7 @@ class ProjectController extends Controller
         if (! $project) {
             return response()->json(['message' => 'Project not found.'], 404);
         }
+        $this->authorize('delete', $project);
         if (! $project->isEmpty()) {
             return response()->json(['message' => 'Project has resources, so it cannot be deleted.'], 400);
         }
@@ -652,6 +656,7 @@ class ProjectController extends Controller
         if (! $project) {
             return response()->json(['message' => 'Project not found.'], 404);
         }
+        $this->authorize('update', $project);
 
         $existingEnvironment = $project->environments()->where('name', $request->name)->first();
         if ($existingEnvironment) {
@@ -746,6 +751,7 @@ class ProjectController extends Controller
         if (! $environment) {
             return response()->json(['message' => 'Environment not found.'], 404);
         }
+        $this->authorize('delete', $environment);
 
         if (! $environment->isEmpty()) {
             return response()->json(['message' => 'Environment has resources, so it cannot be deleted.'], 400);
diff --git a/app/Http/Controllers/Api/SecurityController.php b/app/Http/Controllers/Api/SecurityController.php
index 759af5134..25430631b 100644
--- a/app/Http/Controllers/Api/SecurityController.php
+++ b/app/Http/Controllers/Api/SecurityController.php
@@ -114,6 +114,7 @@ class SecurityController extends Controller
                 'message' => 'Private Key not found.',
             ], 404);
         }
+        $this->authorize('view', $key);
 
         return response()->json($this->removeSensitiveData($key));
     }
@@ -180,6 +181,7 @@ class SecurityController extends Controller
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [PrivateKey::class]);
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
             return $return;
@@ -342,6 +344,7 @@ class SecurityController extends Controller
                 'message' => 'Private Key not found.',
             ], 404);
         }
+        $this->authorize('update', $foundKey);
         $foundKey->update($request->only($allowedFields));
 
         auditLog('api.private_key.updated', [
@@ -425,6 +428,7 @@ class SecurityController extends Controller
         if (is_null($key)) {
             return response()->json(['message' => 'Private Key not found.'], 404);
         }
+        $this->authorize('delete', $key);
 
         if ($key->isInUse()) {
             return response()->json([
diff --git a/app/Http/Controllers/Api/SentinelController.php b/app/Http/Controllers/Api/SentinelController.php
index df5c60d40..3af05f4fa 100644
--- a/app/Http/Controllers/Api/SentinelController.php
+++ b/app/Http/Controllers/Api/SentinelController.php
@@ -97,12 +97,12 @@ class SentinelController extends Controller
 
         if ($this->shouldDispatchUpdate($server, $data)) {
             PushServerUpdateJob::dispatch($server, $data);
-        }
 
-        auditLog('sentinel.metrics_pushed', [
-            'server_uuid' => $server->uuid,
-            'team_id' => $server->team_id,
-        ]);
+            auditLog('sentinel.metrics_pushed', [
+                'server_uuid' => $server->uuid,
+                'team_id' => $server->team_id,
+            ]);
+        }
 
         return response()->json(['message' => 'ok'], 200);
     }
diff --git a/app/Http/Controllers/Api/ServersController.php b/app/Http/Controllers/Api/ServersController.php
index 467b4c06a..a5c74d971 100644
--- a/app/Http/Controllers/Api/ServersController.php
+++ b/app/Http/Controllers/Api/ServersController.php
@@ -156,6 +156,7 @@ class ServersController extends Controller
         if (is_null($server)) {
             return response()->json(['message' => 'Server not found.'], 404);
         }
+        $this->authorize('view', $server);
         if ($with_resources) {
             $server['resources'] = $server->definedResources()->map(function ($resource) {
                 $payload = [
@@ -485,6 +486,7 @@ class ServersController extends Controller
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [ModelsServer::class]);
 
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
@@ -709,6 +711,7 @@ class ServersController extends Controller
         if (! $server) {
             return response()->json(['message' => 'Server not found.'], 404);
         }
+        $this->authorize('update', $server);
         if ($request->proxy_type) {
             $validProxyTypes = collect(ProxyTypes::cases())->map(function ($proxyType) {
                 return str($proxyType->value)->lower();
@@ -833,6 +836,7 @@ class ServersController extends Controller
         if (! $server) {
             return response()->json(['message' => 'Server not found.'], 404);
         }
+        $this->authorize('delete', $server);
 
         $force = filter_var($request->query('force', false), FILTER_VALIDATE_BOOLEAN);
 
@@ -932,6 +936,7 @@ class ServersController extends Controller
         if (! $server) {
             return response()->json(['message' => 'Server not found.'], 404);
         }
+        $this->authorize('update', $server);
         ValidateServer::dispatch($server);
 
         auditLog('api.server.validated', [
diff --git a/app/Http/Controllers/Api/ServicesController.php b/app/Http/Controllers/Api/ServicesController.php
index 773fadd78..fb03c9e1a 100644
--- a/app/Http/Controllers/Api/ServicesController.php
+++ b/app/Http/Controllers/Api/ServicesController.php
@@ -42,6 +42,10 @@ class ServicesController extends Controller
             $this->exposeNestedServerSecrets($service);
         }
 
+        if ($service->is_shown_once ?? false) {
+            $service->makeHidden(['value', 'real_value']);
+        }
+
         return serializeApiResponse($service);
     }
 
diff --git a/app/Http/Controllers/Api/TeamController.php b/app/Http/Controllers/Api/TeamController.php
index 03b36e4e0..d47399533 100644
--- a/app/Http/Controllers/Api/TeamController.php
+++ b/app/Http/Controllers/Api/TeamController.php
@@ -110,6 +110,7 @@ class TeamController extends Controller
         if (is_null($team)) {
             return response()->json(['message' => 'Team not found.'], 404);
         }
+        $this->authorize('view', $team);
         $team = $this->removeSensitiveData($team);
 
         return response()->json(
@@ -168,6 +169,7 @@ class TeamController extends Controller
         if (is_null($team)) {
             return response()->json(['message' => 'Team not found.'], 404);
         }
+        $this->authorize('view', $team);
         $members = $team->members;
         $members->makeHidden([
             'pivot',
diff --git a/app/Http/Controllers/UploadController.php b/app/Http/Controllers/UploadController.php
index 6c3dda402..26a76ab3e 100644
--- a/app/Http/Controllers/UploadController.php
+++ b/app/Http/Controllers/UploadController.php
@@ -2,6 +2,7 @@
 
 namespace App\Http\Controllers;
 
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Http\Request;
 use Illuminate\Http\UploadedFile;
 use Illuminate\Routing\Controller as BaseController;
@@ -11,6 +12,8 @@ use Pion\Laravel\ChunkUpload\Receiver\FileReceiver;
 
 class UploadController extends BaseController
 {
+    use AuthorizesRequests;
+
     private const MAX_BYTES = 10 * 1024 * 1024 * 1024; // 10 GiB
 
     private const ALLOWED_EXTENSIONS = [
@@ -40,6 +43,8 @@ class UploadController extends BaseController
             return response()->json(['error' => 'You do not have permission for this database'], 500);
         }
 
+        $this->authorize('uploadBackup', $resource);
+
         $chunk = $request->file('file');
         $originalName = $chunk instanceof UploadedFile ? $chunk->getClientOriginalName() : null;
         if (blank($originalName) || ! self::hasAllowedExtension($originalName)) {
diff --git a/app/Http/Controllers/Webhook/Bitbucket.php b/app/Http/Controllers/Webhook/Bitbucket.php
index d37ba7cee..435f5efab 100644
--- a/app/Http/Controllers/Webhook/Bitbucket.php
+++ b/app/Http/Controllers/Webhook/Bitbucket.php
@@ -10,7 +10,6 @@ use App\Models\Application;
 use App\Models\ApplicationPreview;
 use Exception;
 use Illuminate\Http\Request;
-use Visus\Cuid2\Cuid2;
 
 class Bitbucket extends Controller
 {
@@ -141,7 +140,7 @@ class Bitbucket extends Controller
 
                             continue;
                         }
-                        $deployment_uuid = new Cuid2;
+                        $deployment_uuid = new_public_id();
                         $result = queue_application_deployment(
                             application: $application,
                             deployment_uuid: $deployment_uuid,
@@ -192,7 +191,7 @@ class Bitbucket extends Controller
 
                             continue;
                         }
-                        $deployment_uuid = new Cuid2;
+                        $deployment_uuid = new_public_id();
                         $found = ApplicationPreview::where('application_id', $application->id)->where('pull_request_id', $pull_request_id)->first();
                         if (! $found) {
                             if ($application->build_pack === 'dockercompose') {
diff --git a/app/Http/Controllers/Webhook/Gitea.php b/app/Http/Controllers/Webhook/Gitea.php
index be064e380..82a8cc8af 100644
--- a/app/Http/Controllers/Webhook/Gitea.php
+++ b/app/Http/Controllers/Webhook/Gitea.php
@@ -11,7 +11,6 @@ use App\Models\ApplicationPreview;
 use Exception;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
-use Visus\Cuid2\Cuid2;
 
 class Gitea extends Controller
 {
@@ -127,7 +126,7 @@ class Gitea extends Controller
 
                                 continue;
                             }
-                            $deployment_uuid = new Cuid2;
+                            $deployment_uuid = new_public_id();
                             $result = queue_application_deployment(
                                 application: $application,
                                 deployment_uuid: $deployment_uuid,
@@ -194,7 +193,7 @@ class Gitea extends Controller
 
                                 continue;
                             }
-                            $deployment_uuid = new Cuid2;
+                            $deployment_uuid = new_public_id();
                             $found = ApplicationPreview::where('application_id', $application->id)->where('pull_request_id', $pull_request_id)->first();
                             if (! $found) {
                                 if ($application->build_pack === 'dockercompose') {
diff --git a/app/Http/Controllers/Webhook/Github.php b/app/Http/Controllers/Webhook/Github.php
index 40c5cbdf0..c9b0116fb 100644
--- a/app/Http/Controllers/Webhook/Github.php
+++ b/app/Http/Controllers/Webhook/Github.php
@@ -17,7 +17,6 @@ use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Str;
-use Visus\Cuid2\Cuid2;
 
 class Github extends Controller
 {
@@ -144,7 +143,7 @@ class Github extends Controller
 
                                     continue;
                                 }
-                                $deployment_uuid = new Cuid2;
+                                $deployment_uuid = new_public_id();
                                 $result = queue_application_deployment(
                                     application: $application,
                                     deployment_uuid: $deployment_uuid,
@@ -362,7 +361,7 @@ class Github extends Controller
 
                                     continue;
                                 }
-                                $deployment_uuid = new Cuid2;
+                                $deployment_uuid = new_public_id();
                                 $result = queue_application_deployment(
                                     application: $application,
                                     deployment_uuid: $deployment_uuid,
diff --git a/app/Http/Controllers/Webhook/Gitlab.php b/app/Http/Controllers/Webhook/Gitlab.php
index 231a0b6e5..c90f4ad40 100644
--- a/app/Http/Controllers/Webhook/Gitlab.php
+++ b/app/Http/Controllers/Webhook/Gitlab.php
@@ -11,7 +11,6 @@ use App\Models\ApplicationPreview;
 use Exception;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
-use Visus\Cuid2\Cuid2;
 
 class Gitlab extends Controller
 {
@@ -168,7 +167,7 @@ class Gitlab extends Controller
 
                                 continue;
                             }
-                            $deployment_uuid = new Cuid2;
+                            $deployment_uuid = new_public_id();
                             $result = queue_application_deployment(
                                 application: $application,
                                 deployment_uuid: $deployment_uuid,
@@ -236,7 +235,7 @@ class Gitlab extends Controller
 
                                 continue;
                             }
-                            $deployment_uuid = new Cuid2;
+                            $deployment_uuid = new_public_id();
                             $found = ApplicationPreview::where('application_id', $application->id)->where('pull_request_id', $pull_request_id)->first();
                             if (! $found) {
                                 if ($application->build_pack === 'dockercompose') {
diff --git a/app/Http/Middleware/ApiAbility.php b/app/Http/Middleware/ApiAbility.php
index f81c7d184..8951ad50d 100644
--- a/app/Http/Middleware/ApiAbility.php
+++ b/app/Http/Middleware/ApiAbility.php
@@ -7,9 +7,34 @@ use Laravel\Sanctum\Http\Middleware\CheckForAnyAbility;
 
 class ApiAbility extends CheckForAnyAbility
 {
+    /**
+     * Permissions that only admins/owners may use.
+     */
+    private const MEMBER_DISALLOWED_ABILITIES = [
+        'root',
+        'write',
+        'write:sensitive',
+        'deploy',
+        'read:sensitive',
+    ];
+
     public function handle($request, $next, ...$abilities)
     {
         try {
+            $token = $request->user()->currentAccessToken();
+            $teamId = data_get($token, 'team_id');
+
+            if ($teamId !== null && ! $request->user()->isAdminOfTeam((int) $teamId)) {
+                $tokenAbilities = $token->abilities ?? [];
+                $disallowed = array_intersect($tokenAbilities, self::MEMBER_DISALLOWED_ABILITIES);
+
+                if (! empty($disallowed)) {
+                    return response()->json([
+                        'message' => 'This API token has permissions ('.implode(', ', $disallowed).') that exceed your current role as a team member. Members are restricted to read-only API access. Please revoke this token and create a new one with only read permissions.',
+                    ], 403);
+                }
+            }
+
             if ($request->user()->tokenCan('root')) {
                 return $next($request);
             }
diff --git a/app/Http/Middleware/ApiSensitiveData.php b/app/Http/Middleware/ApiSensitiveData.php
index 49584ddb3..8d7c51d11 100644
--- a/app/Http/Middleware/ApiSensitiveData.php
+++ b/app/Http/Middleware/ApiSensitiveData.php
@@ -10,10 +10,13 @@ class ApiSensitiveData
     public function handle(Request $request, Closure $next)
     {
         $token = $request->user()->currentAccessToken();
+        $hasTokenPermission = $token->can('root') || $token->can('read:sensitive');
+        $teamId = (int) data_get($token, 'team_id');
+        $isAdmin = $teamId ? $request->user()->isAdminOfTeam($teamId) : false;
 
-        // Allow access to sensitive data if token has root or read:sensitive permission
+        // Allow access to sensitive data only if token has permission AND user is admin/owner
         $request->attributes->add([
-            'can_read_sensitive' => $token->can('root') || $token->can('read:sensitive'),
+            'can_read_sensitive' => $hasTokenPermission && $isAdmin,
         ]);
 
         return $next($request);
diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 1b8ef3fc4..20eae036b 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -37,7 +37,6 @@ use JsonException;
 use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
 use Throwable;
-use Visus\Cuid2\Cuid2;
 
 class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 {
@@ -2207,7 +2206,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
                 continue;
             }
-            $deployment_uuid = new Cuid2;
+            $deployment_uuid = new_public_id();
             queue_application_deployment(
                 deployment_uuid: $deployment_uuid,
                 application: $this->application,
diff --git a/app/Jobs/DatabaseBackupJob.php b/app/Jobs/DatabaseBackupJob.php
index 64e900b49..79bf929be 100644
--- a/app/Jobs/DatabaseBackupJob.php
+++ b/app/Jobs/DatabaseBackupJob.php
@@ -27,7 +27,6 @@ use Illuminate\Queue\SerializesModels;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
 use Throwable;
-use Visus\Cuid2\Cuid2;
 
 class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
 {
@@ -309,7 +308,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                 // Generate unique UUID for each database backup execution
                 $attempts = 0;
                 do {
-                    $this->backup_log_uuid = (string) new Cuid2;
+                    $this->backup_log_uuid = new_public_id();
                     $exists = ScheduledDatabaseBackupExecution::where('uuid', $this->backup_log_uuid)->exists();
                     $attempts++;
                     if ($attempts >= 3 && $exists) {
diff --git a/app/Jobs/ProcessGithubPullRequestWebhook.php b/app/Jobs/ProcessGithubPullRequestWebhook.php
index d35ecf35a..61fc3d4ee 100644
--- a/app/Jobs/ProcessGithubPullRequestWebhook.php
+++ b/app/Jobs/ProcessGithubPullRequestWebhook.php
@@ -15,7 +15,6 @@ use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 use Throwable;
-use Visus\Cuid2\Cuid2;
 
 class ProcessGithubPullRequestWebhook implements ShouldBeEncrypted, ShouldQueue
 {
@@ -166,7 +165,7 @@ class ProcessGithubPullRequestWebhook implements ShouldBeEncrypted, ShouldQueue
         }
 
         // Queue the deployment
-        $deployment_uuid = new Cuid2;
+        $deployment_uuid = new_public_id();
         queue_application_deployment(
             application: $application,
             pull_request_id: $this->pullRequestId,
diff --git a/app/Livewire/Admin/Index.php b/app/Livewire/Admin/Index.php
index 4d22047cc..226d2e332 100644
--- a/app/Livewire/Admin/Index.php
+++ b/app/Livewire/Admin/Index.php
@@ -54,6 +54,9 @@ class Index extends Component
 
     public function getSubscribers()
     {
+        if (Auth::id() !== 0 && ! session('impersonating')) {
+            return redirect()->route('dashboard');
+        }
         $this->inactiveSubscribers = Team::whereRelation('subscription', 'stripe_invoice_paid', false)->count();
         $this->activeSubscribers = Team::whereRelation('subscription', 'stripe_invoice_paid', true)->count();
     }
diff --git a/app/Livewire/Boarding/Index.php b/app/Livewire/Boarding/Index.php
index 2d0ae939d..5582efbda 100644
--- a/app/Livewire/Boarding/Index.php
+++ b/app/Livewire/Boarding/Index.php
@@ -9,13 +9,15 @@ use App\Models\Server;
 use App\Models\Team;
 use App\Services\ConfigurationRepository;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Url;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Index extends Component
 {
+    use AuthorizesRequests;
+
     protected $listeners = [
         'refreshBoardingIndex' => 'validateServer',
         'prerequisitesInstalled' => 'handlePrerequisitesInstalled',
@@ -174,6 +176,9 @@ class Index extends Component
 
     public function skipBoarding()
     {
+        if (auth()->user()?->isMember()) {
+            return redirect()->route('dashboard');
+        }
         Team::find(currentTeam()->id)->update([
             'show_boarding' => false,
         ]);
@@ -276,6 +281,7 @@ class Index extends Component
         ]);
 
         try {
+            $this->authorize('create', PrivateKey::class);
             $privateKey = PrivateKey::createAndStore([
                 'name' => $this->privateKeyName,
                 'description' => $this->privateKeyDescription,
@@ -294,6 +300,12 @@ class Index extends Component
     {
         $this->validate();
 
+        try {
+            $this->authorize('create', Server::class);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+
         $this->privateKey = formatPrivateKey($this->privateKey);
         $foundServer = Server::whereIp($this->remoteServerHost)->first();
         if ($foundServer) {
@@ -457,7 +469,7 @@ class Index extends Component
         $this->createdProject = Project::create([
             'name' => 'My first project',
             'team_id' => currentTeam()->id,
-            'uuid' => (string) new Cuid2,
+            'uuid' => new_public_id(),
         ]);
         $this->currentState = 'create-resource';
     }
diff --git a/app/Livewire/Destination/New/Docker.php b/app/Livewire/Destination/New/Docker.php
index 254823163..61e8bba34 100644
--- a/app/Livewire/Destination/New/Docker.php
+++ b/app/Livewire/Destination/New/Docker.php
@@ -9,7 +9,6 @@ use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Docker extends Component
 {
@@ -35,7 +34,7 @@ class Docker extends Component
 
     public function mount(?string $server_id = null): void
     {
-        $this->network = (string) new Cuid2;
+        $this->network = new_public_id();
         $this->servers = Server::isUsable()->get();
 
         if (filled($server_id)) {
@@ -68,7 +67,7 @@ class Docker extends Component
 
     public function generateName(): void
     {
-        $name = data_get($this->selectedServer, 'name', new Cuid2);
+        $name = data_get($this->selectedServer, 'name', new_public_id());
         $this->name = str("{$name}-{$this->network}")->kebab();
     }
 
diff --git a/app/Livewire/Destination/Show.php b/app/Livewire/Destination/Show.php
index 9d55d7462..1b344c905 100644
--- a/app/Livewire/Destination/Show.php
+++ b/app/Livewire/Destination/Show.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Destination;
 
 use App\Models\StandaloneDocker;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
@@ -31,8 +32,12 @@ class Show extends Component
             if (! $destination) {
                 return redirect()->route('destination.index');
             }
+            $this->authorize('view', $destination);
+
             $this->destination = $destination;
             $this->syncData();
+        } catch (AuthorizationException) {
+            abort(403);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/MonacoEditor.php b/app/Livewire/MonacoEditor.php
index f660f9c13..cf476eb75 100644
--- a/app/Livewire/MonacoEditor.php
+++ b/app/Livewire/MonacoEditor.php
@@ -4,7 +4,6 @@ namespace App\Livewire;
 
 // use Livewire\Component;
 use Illuminate\View\Component;
-use Visus\Cuid2\Cuid2;
 
 class MonacoEditor extends Component
 {
@@ -40,7 +39,7 @@ class MonacoEditor extends Component
     public function render()
     {
         if (is_null($this->id)) {
-            $this->id = new Cuid2;
+            $this->id = new_public_id();
         }
 
         if (is_null($this->name)) {
diff --git a/app/Livewire/NavbarDeleteTeam.php b/app/Livewire/NavbarDeleteTeam.php
index 8e5478b5e..52e4460ad 100644
--- a/app/Livewire/NavbarDeleteTeam.php
+++ b/app/Livewire/NavbarDeleteTeam.php
@@ -2,12 +2,16 @@
 
 namespace App\Livewire;
 
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
 use Livewire\Component;
 
 class NavbarDeleteTeam extends Component
 {
+    use AuthorizesRequests;
+
     public $team;
 
     public function mount()
@@ -17,27 +21,35 @@ class NavbarDeleteTeam extends Component
 
     public function delete($password, $selectedActions = [])
     {
-        if (! verifyPasswordConfirmation($password, $this)) {
-            return 'The provided password is incorrect.';
+        try {
+            if (! verifyPasswordConfirmation($password, $this)) {
+                return 'The provided password is incorrect.';
+            }
+
+            $currentTeam = currentTeam();
+            $this->authorize('delete', $currentTeam);
+
+            $currentTeam->members->each(function ($user) use ($currentTeam) {
+                if ($user->id === Auth::id()) {
+                    return;
+                }
+                $user->teams()->detach($currentTeam);
+                $session = DB::table('sessions')->where('user_id', $user->id)->first();
+                if ($session) {
+                    DB::table('sessions')->where('id', $session->id)->delete();
+                }
+            });
+
+            Cache::forget('user:'.Auth::id().':team:'.$currentTeam->id);
+            $currentTeam->delete();
+
+            $newTeam = Auth::user()->teams()->first();
+            refreshSession($newTeam);
+
+            return redirect()->route('team.index');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-
-        $currentTeam = currentTeam();
-        $currentTeam->delete();
-
-        $currentTeam->members->each(function ($user) use ($currentTeam) {
-            if ($user->id === Auth::id()) {
-                return;
-            }
-            $user->teams()->detach($currentTeam);
-            $session = DB::table('sessions')->where('user_id', $user->id)->first();
-            if ($session) {
-                DB::table('sessions')->where('id', $session->id)->delete();
-            }
-        });
-
-        refreshSession();
-
-        return redirectRoute($this, 'team.index');
     }
 
     public function render()
diff --git a/app/Livewire/Notifications/Discord.php b/app/Livewire/Notifications/Discord.php
index ab3884320..59350a3e1 100644
--- a/app/Livewire/Notifications/Discord.php
+++ b/app/Livewire/Notifications/Discord.php
@@ -110,7 +110,9 @@ class Discord extends Component
             refreshSession();
         } else {
             $this->discordEnabled = $this->settings->discord_enabled;
-            $this->discordWebhookUrl = $this->settings->discord_webhook_url;
+            $this->discordWebhookUrl = auth()->user()->can('update', $this->settings)
+                ? $this->settings->discord_webhook_url
+                : null;
 
             $this->deploymentSuccessDiscordNotifications = $this->settings->deployment_success_discord_notifications;
             $this->deploymentFailureDiscordNotifications = $this->settings->deployment_failure_discord_notifications;
diff --git a/app/Livewire/Notifications/Pushover.php b/app/Livewire/Notifications/Pushover.php
index d79eea87b..f894c5005 100644
--- a/app/Livewire/Notifications/Pushover.php
+++ b/app/Livewire/Notifications/Pushover.php
@@ -113,8 +113,13 @@ class Pushover extends Component
             refreshSession();
         } else {
             $this->pushoverEnabled = $this->settings->pushover_enabled;
-            $this->pushoverUserKey = $this->settings->pushover_user_key;
-            $this->pushoverApiToken = $this->settings->pushover_api_token;
+            if (auth()->user()->can('update', $this->settings)) {
+                $this->pushoverUserKey = $this->settings->pushover_user_key;
+                $this->pushoverApiToken = $this->settings->pushover_api_token;
+            } else {
+                $this->pushoverUserKey = null;
+                $this->pushoverApiToken = null;
+            }
 
             $this->deploymentSuccessPushoverNotifications = $this->settings->deployment_success_pushover_notifications;
             $this->deploymentFailurePushoverNotifications = $this->settings->deployment_failure_pushover_notifications;
diff --git a/app/Livewire/Notifications/Slack.php b/app/Livewire/Notifications/Slack.php
index f870b3986..58cab5494 100644
--- a/app/Livewire/Notifications/Slack.php
+++ b/app/Livewire/Notifications/Slack.php
@@ -110,7 +110,9 @@ class Slack extends Component
             refreshSession();
         } else {
             $this->slackEnabled = $this->settings->slack_enabled;
-            $this->slackWebhookUrl = $this->settings->slack_webhook_url;
+            $this->slackWebhookUrl = auth()->user()->can('update', $this->settings)
+                ? $this->settings->slack_webhook_url
+                : null;
 
             $this->deploymentSuccessSlackNotifications = $this->settings->deployment_success_slack_notifications;
             $this->deploymentFailureSlackNotifications = $this->settings->deployment_failure_slack_notifications;
diff --git a/app/Livewire/Notifications/Telegram.php b/app/Livewire/Notifications/Telegram.php
index fc3966cf6..78eb7ef9f 100644
--- a/app/Livewire/Notifications/Telegram.php
+++ b/app/Livewire/Notifications/Telegram.php
@@ -169,8 +169,13 @@ class Telegram extends Component
             $this->settings->save();
         } else {
             $this->telegramEnabled = $this->settings->telegram_enabled;
-            $this->telegramToken = $this->settings->telegram_token;
-            $this->telegramChatId = $this->settings->telegram_chat_id;
+            if (auth()->user()->can('update', $this->settings)) {
+                $this->telegramToken = $this->settings->telegram_token;
+                $this->telegramChatId = $this->settings->telegram_chat_id;
+            } else {
+                $this->telegramToken = null;
+                $this->telegramChatId = null;
+            }
 
             $this->deploymentSuccessTelegramNotifications = $this->settings->deployment_success_telegram_notifications;
             $this->deploymentFailureTelegramNotifications = $this->settings->deployment_failure_telegram_notifications;
diff --git a/app/Livewire/Notifications/Webhook.php b/app/Livewire/Notifications/Webhook.php
index 630d422a9..4a67180ff 100644
--- a/app/Livewire/Notifications/Webhook.php
+++ b/app/Livewire/Notifications/Webhook.php
@@ -105,7 +105,9 @@ class Webhook extends Component
             refreshSession();
         } else {
             $this->webhookEnabled = $this->settings->webhook_enabled;
-            $this->webhookUrl = $this->settings->webhook_url;
+            $this->webhookUrl = auth()->user()->can('update', $this->settings)
+                ? $this->settings->webhook_url
+                : null;
 
             $this->deploymentSuccessWebhookNotifications = $this->settings->deployment_success_webhook_notifications;
             $this->deploymentFailureWebhookNotifications = $this->settings->deployment_failure_webhook_notifications;
diff --git a/app/Livewire/Project/AddEmpty.php b/app/Livewire/Project/AddEmpty.php
index 974f0608a..e004ac69e 100644
--- a/app/Livewire/Project/AddEmpty.php
+++ b/app/Livewire/Project/AddEmpty.php
@@ -4,11 +4,13 @@ namespace App\Livewire\Project;
 
 use App\Models\Project;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class AddEmpty extends Component
 {
+    use AuthorizesRequests;
+
     public string $name;
 
     public string $description = '';
@@ -29,12 +31,13 @@ class AddEmpty extends Component
     public function submit()
     {
         try {
+            $this->authorize('create', Project::class);
             $this->validate();
             $project = Project::create([
                 'name' => $this->name,
                 'description' => $this->description,
                 'team_id' => currentTeam()->id,
-                'uuid' => (string) new Cuid2,
+                'uuid' => new_public_id(),
             ]);
 
             $productionEnvironment = $project->environments()->where('name', 'production')->first();
diff --git a/app/Livewire/Project/Application/Deployment/Show.php b/app/Livewire/Project/Application/Deployment/Show.php
index c9f818e2c..9ed0ab807 100644
--- a/app/Livewire/Project/Application/Deployment/Show.php
+++ b/app/Livewire/Project/Application/Deployment/Show.php
@@ -59,7 +59,9 @@ class Show extends Component
         $this->application_deployment_queue = $application_deployment_queue;
         $this->horizon_job_status = $this->application_deployment_queue->getHorizonJobStatus();
         $this->deployment_uuid = $deploymentUuid;
-        $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
+        $this->is_debug_enabled = auth()->user()->isMember()
+            ? false
+            : $this->application->settings->is_debug_enabled;
         $this->isKeepAliveOn();
     }
 
@@ -110,6 +112,8 @@ class Show extends Component
 
     public function downloadAllLogs(): string
     {
+        $this->authorize('update', $this->application);
+
         $logs = decode_remote_command_output($this->application_deployment_queue, includeAll: true)
             ->map(function ($line) {
                 $prefix = '';
diff --git a/app/Livewire/Project/Application/DeploymentNavbar.php b/app/Livewire/Project/Application/DeploymentNavbar.php
index ebdc014ae..b60f543ba 100644
--- a/app/Livewire/Project/Application/DeploymentNavbar.php
+++ b/app/Livewire/Project/Application/DeploymentNavbar.php
@@ -6,11 +6,14 @@ use App\Enums\ApplicationDeploymentStatus;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Carbon;
 use Livewire\Component;
 
 class DeploymentNavbar extends Component
 {
+    use AuthorizesRequests;
+
     public ApplicationDeploymentQueue $application_deployment_queue;
 
     public Application $application;
@@ -25,7 +28,9 @@ class DeploymentNavbar extends Component
     {
         $this->application = Application::ownedByCurrentTeam()->find($this->application_deployment_queue->application_id);
         $this->server = $this->application->destination->server;
-        $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
+        $this->is_debug_enabled = auth()->user()->isMember()
+            ? false
+            : $this->application->settings->is_debug_enabled;
     }
 
     public function deploymentFinished()
@@ -35,15 +40,21 @@ class DeploymentNavbar extends Component
 
     public function show_debug()
     {
-        $this->application->settings->is_debug_enabled = ! $this->application->settings->is_debug_enabled;
-        $this->application->settings->save();
-        $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
-        $this->dispatch('refreshQueue');
+        try {
+            $this->authorize('update', $this->application);
+            $this->application->settings->is_debug_enabled = ! $this->application->settings->is_debug_enabled;
+            $this->application->settings->save();
+            $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
+            $this->dispatch('refreshQueue');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function force_start()
     {
         try {
+            $this->authorize('deploy', $this->application);
             force_start_deployment($this->application_deployment_queue);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -58,10 +69,15 @@ class DeploymentNavbar extends Component
             return '';
         }
 
+        $isMember = auth()->user()->isMember();
+
         $markdown = "# Deployment Logs\n\n";
         $markdown .= "```\n";
 
         foreach ($logs as $log) {
+            if ($isMember && ! empty($log['hidden'])) {
+                continue;
+            }
             if (isset($log['output'])) {
                 $markdown .= $log['output']."\n";
             }
@@ -74,6 +90,11 @@ class DeploymentNavbar extends Component
 
     public function cancel()
     {
+        try {
+            $this->authorize('deploy', $this->application);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
         $deployment_uuid = $this->application_deployment_queue->deployment_uuid;
         $kill_command = "docker rm -f {$deployment_uuid}";
         $build_server_id = $this->application_deployment_queue->build_server_id ?? $this->application->destination->server_id;
diff --git a/app/Livewire/Project/Application/General.php b/app/Livewire/Project/Application/General.php
index 89b1b4217..7af0a275d 100644
--- a/app/Livewire/Project/Application/General.php
+++ b/app/Livewire/Project/Application/General.php
@@ -13,7 +13,6 @@ use Illuminate\Support\Collection;
 use Livewire\Component;
 use Livewire\Features\SupportEvents\Event;
 use Spatie\Url\Url;
-use Visus\Cuid2\Cuid2;
 
 class General extends Component
 {
@@ -549,7 +548,7 @@ class General extends Component
         try {
             $this->authorize('update', $this->application);
 
-            $uuid = new Cuid2;
+            $uuid = new_public_id();
             $domain = generateUrl(server: $this->application->destination->server, random: $uuid);
             $sanitizedKey = str($serviceName)->replace('-', '_')->replace('.', '_')->toString();
             $this->parsedServiceDomains[$sanitizedKey]['domain'] = $domain;
diff --git a/app/Livewire/Project/Application/Heading.php b/app/Livewire/Project/Application/Heading.php
index a46b2f19c..b7750e087 100644
--- a/app/Livewire/Project/Application/Heading.php
+++ b/app/Livewire/Project/Application/Heading.php
@@ -7,7 +7,6 @@ use App\Actions\Docker\GetContainersStatus;
 use App\Models\Application;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Heading extends Component
 {
@@ -65,107 +64,123 @@ class Heading extends Component
 
     public function force_deploy_without_cache()
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        $this->deploy(force_rebuild: true);
+            $this->deploy(force_rebuild: true);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function deploy(bool $force_rebuild = false)
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        if ($this->application->build_pack === 'dockercompose' && is_null($this->application->docker_compose_raw)) {
-            $this->dispatch('error', 'Failed to deploy', 'Please load a Compose file first.');
+            if ($this->application->build_pack === 'dockercompose' && is_null($this->application->docker_compose_raw)) {
+                $this->dispatch('error', 'Failed to deploy', 'Please load a Compose file first.');
 
-            return;
+                return;
+            }
+            if ($this->application->destination->server->isSwarm() && str($this->application->docker_registry_image_name)->isEmpty()) {
+                $this->dispatch('error', 'Failed to deploy.', 'To deploy to a Swarm cluster you must set a Docker image name first.');
+
+                return;
+            }
+            if (data_get($this->application, 'settings.is_build_server_enabled') && str($this->application->docker_registry_image_name)->isEmpty()) {
+                $this->dispatch('error', 'Failed to deploy.', 'To use a build server, you must first set a Docker image.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/build-server">documentation</a>');
+
+                return;
+            }
+            if ($this->application->additional_servers->count() > 0 && str($this->application->docker_registry_image_name)->isEmpty()) {
+                $this->dispatch('error', 'Failed to deploy.', 'Before deploying to multiple servers, you must first set a Docker image in the General tab.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/multiple-servers">documentation</a>');
+
+                return;
+            }
+            $this->setDeploymentUuid();
+            $result = queue_application_deployment(
+                application: $this->application,
+                deployment_uuid: $this->deploymentUuid,
+                force_rebuild: $force_rebuild,
+            );
+            if ($result['status'] === 'queue_full') {
+                $this->dispatch('error', 'Deployment queue full', $result['message']);
+
+                return;
+            }
+            if ($result['status'] === 'skipped') {
+                $this->dispatch('error', 'Deployment skipped', $result['message']);
+
+                return;
+            }
+
+            return $this->redirectRoute('project.application.deployment.show', [
+                'project_uuid' => $this->parameters['project_uuid'],
+                'application_uuid' => $this->parameters['application_uuid'],
+                'deployment_uuid' => $this->deploymentUuid,
+                'environment_uuid' => $this->parameters['environment_uuid'],
+            ], navigate: false);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        if ($this->application->destination->server->isSwarm() && str($this->application->docker_registry_image_name)->isEmpty()) {
-            $this->dispatch('error', 'Failed to deploy.', 'To deploy to a Swarm cluster you must set a Docker image name first.');
-
-            return;
-        }
-        if (data_get($this->application, 'settings.is_build_server_enabled') && str($this->application->docker_registry_image_name)->isEmpty()) {
-            $this->dispatch('error', 'Failed to deploy.', 'To use a build server, you must first set a Docker image.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/build-server">documentation</a>');
-
-            return;
-        }
-        if ($this->application->additional_servers->count() > 0 && str($this->application->docker_registry_image_name)->isEmpty()) {
-            $this->dispatch('error', 'Failed to deploy.', 'Before deploying to multiple servers, you must first set a Docker image in the General tab.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/multiple-servers">documentation</a>');
-
-            return;
-        }
-        $this->setDeploymentUuid();
-        $result = queue_application_deployment(
-            application: $this->application,
-            deployment_uuid: $this->deploymentUuid,
-            force_rebuild: $force_rebuild,
-        );
-        if ($result['status'] === 'queue_full') {
-            $this->dispatch('error', 'Deployment queue full', $result['message']);
-
-            return;
-        }
-        if ($result['status'] === 'skipped') {
-            $this->dispatch('error', 'Deployment skipped', $result['message']);
-
-            return;
-        }
-
-        return $this->redirectRoute('project.application.deployment.show', [
-            'project_uuid' => $this->parameters['project_uuid'],
-            'application_uuid' => $this->parameters['application_uuid'],
-            'deployment_uuid' => $this->deploymentUuid,
-            'environment_uuid' => $this->parameters['environment_uuid'],
-        ], navigate: false);
     }
 
     protected function setDeploymentUuid()
     {
-        $this->deploymentUuid = new Cuid2;
+        $this->deploymentUuid = new_public_id();
         $this->parameters['deployment_uuid'] = $this->deploymentUuid;
     }
 
     public function stop()
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        $this->dispatch('info', 'Gracefully stopping application.<br/>It could take a while depending on the application.');
-        StopApplication::dispatch($this->application, false, $this->docker_cleanup);
+            $this->dispatch('info', 'Gracefully stopping application.<br/>It could take a while depending on the application.');
+            StopApplication::dispatch($this->application, false, $this->docker_cleanup);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function restart()
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        if ($this->application->additional_servers->count() > 0 && str($this->application->docker_registry_image_name)->isEmpty()) {
-            $this->dispatch('error', 'Failed to deploy', 'Before deploying to multiple servers, you must first set a Docker image in the General tab.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/multiple-servers">documentation</a>');
+            if ($this->application->additional_servers->count() > 0 && str($this->application->docker_registry_image_name)->isEmpty()) {
+                $this->dispatch('error', 'Failed to deploy', 'Before deploying to multiple servers, you must first set a Docker image in the General tab.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/multiple-servers">documentation</a>');
 
-            return;
+                return;
+            }
+
+            $this->setDeploymentUuid();
+            $result = queue_application_deployment(
+                application: $this->application,
+                deployment_uuid: $this->deploymentUuid,
+                restart_only: true,
+            );
+            if ($result['status'] === 'queue_full') {
+                $this->dispatch('error', 'Deployment queue full', $result['message']);
+
+                return;
+            }
+            if ($result['status'] === 'skipped') {
+                $this->dispatch('success', 'Deployment skipped', $result['message']);
+
+                return;
+            }
+
+            return $this->redirectRoute('project.application.deployment.show', [
+                'project_uuid' => $this->parameters['project_uuid'],
+                'application_uuid' => $this->parameters['application_uuid'],
+                'deployment_uuid' => $this->deploymentUuid,
+                'environment_uuid' => $this->parameters['environment_uuid'],
+            ], navigate: false);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-
-        $this->setDeploymentUuid();
-        $result = queue_application_deployment(
-            application: $this->application,
-            deployment_uuid: $this->deploymentUuid,
-            restart_only: true,
-        );
-        if ($result['status'] === 'queue_full') {
-            $this->dispatch('error', 'Deployment queue full', $result['message']);
-
-            return;
-        }
-        if ($result['status'] === 'skipped') {
-            $this->dispatch('success', 'Deployment skipped', $result['message']);
-
-            return;
-        }
-
-        return $this->redirectRoute('project.application.deployment.show', [
-            'project_uuid' => $this->parameters['project_uuid'],
-            'application_uuid' => $this->parameters['application_uuid'],
-            'deployment_uuid' => $this->deploymentUuid,
-            'environment_uuid' => $this->parameters['environment_uuid'],
-        ], navigate: false);
     }
 
     public function render()
diff --git a/app/Livewire/Project/Application/Previews.php b/app/Livewire/Project/Application/Previews.php
index 59b52f557..74b2ebce8 100644
--- a/app/Livewire/Project/Application/Previews.php
+++ b/app/Livewire/Project/Application/Previews.php
@@ -9,7 +9,6 @@ use App\Models\ApplicationPreview;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Previews extends Component
 {
@@ -234,31 +233,38 @@ class Previews extends Component
 
     public function force_deploy_without_cache(int $pull_request_id, ?string $pull_request_html_url = null)
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        $dockerRegistryImageTag = null;
-        if ($this->application->build_pack === 'dockerimage') {
-            $dockerRegistryImageTag = $this->application->previews()
-                ->where('pull_request_id', $pull_request_id)
-                ->value('docker_registry_image_tag');
+            $dockerRegistryImageTag = null;
+            if ($this->application->build_pack === 'dockerimage') {
+                $dockerRegistryImageTag = $this->application->previews()
+                    ->where('pull_request_id', $pull_request_id)
+                    ->value('docker_registry_image_tag');
+            }
+
+            $this->deploy($pull_request_id, $pull_request_html_url, force_rebuild: true, docker_registry_image_tag: $dockerRegistryImageTag);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-
-        $this->deploy($pull_request_id, $pull_request_html_url, force_rebuild: true, docker_registry_image_tag: $dockerRegistryImageTag);
     }
 
     public function add_and_deploy(int $pull_request_id, ?string $pull_request_html_url = null, ?string $docker_registry_image_tag = null)
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        $this->add($pull_request_id, $pull_request_html_url, $docker_registry_image_tag);
-        $this->deploy($pull_request_id, $pull_request_html_url, force_rebuild: false, docker_registry_image_tag: $docker_registry_image_tag);
+            $this->add($pull_request_id, $pull_request_html_url, $docker_registry_image_tag);
+            $this->deploy($pull_request_id, $pull_request_html_url, force_rebuild: false, docker_registry_image_tag: $docker_registry_image_tag);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function deploy(int $pull_request_id, ?string $pull_request_html_url = null, bool $force_rebuild = false, ?string $docker_registry_image_tag = null)
     {
-        $this->authorize('deploy', $this->application);
-
         try {
+            $this->authorize('deploy', $this->application);
             $this->setDeploymentUuid();
             $found = ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', $pull_request_id)->first();
             if (! $found && (! is_null($pull_request_html_url) || ($this->application->build_pack === 'dockerimage' && str($docker_registry_image_tag)->isNotEmpty()))) {
@@ -305,7 +311,7 @@ class Previews extends Component
 
     protected function setDeploymentUuid()
     {
-        $this->deployment_uuid = new Cuid2;
+        $this->deployment_uuid = new_public_id();
         $this->parameters['deployment_uuid'] = $this->deployment_uuid;
     }
 
@@ -350,9 +356,8 @@ class Previews extends Component
 
     public function stop(int $pull_request_id)
     {
-        $this->authorize('deploy', $this->application);
-
         try {
+            $this->authorize('deploy', $this->application);
             $server = $this->application->destination->server;
 
             if ($this->application->destination->server->isSwarm()) {
diff --git a/app/Livewire/Project/Application/PreviewsCompose.php b/app/Livewire/Project/Application/PreviewsCompose.php
index 85ba2328e..e8da3b45c 100644
--- a/app/Livewire/Project/Application/PreviewsCompose.php
+++ b/app/Livewire/Project/Application/PreviewsCompose.php
@@ -6,7 +6,6 @@ use App\Models\ApplicationPreview;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 use Spatie\Url\Url;
-use Visus\Cuid2\Cuid2;
 
 class PreviewsCompose extends Component
 {
@@ -64,7 +63,7 @@ class PreviewsCompose extends Component
             if (empty($domain_string)) {
                 $server = $this->preview->application->destination->server;
                 $template = $this->preview->application->preview_url_template;
-                $random = new Cuid2;
+                $random = new_public_id();
 
                 // Generate a unique domain like main app services do
                 $generated_fqdn = generateUrl(server: $server, random: $random);
@@ -79,7 +78,7 @@ class PreviewsCompose extends Component
                 $domain_list = explode(',', $domain_string);
                 $preview_fqdns = [];
                 $template = $this->preview->application->preview_url_template;
-                $random = new Cuid2;
+                $random = new_public_id();
 
                 foreach ($domain_list as $single_domain) {
                     $single_domain = trim($single_domain);
diff --git a/app/Livewire/Project/Application/Rollback.php b/app/Livewire/Project/Application/Rollback.php
index 3edd77833..b070ae1cc 100644
--- a/app/Livewire/Project/Application/Rollback.php
+++ b/app/Livewire/Project/Application/Rollback.php
@@ -6,7 +6,6 @@ use App\Models\Application;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Rollback extends Component
 {
@@ -52,7 +51,7 @@ class Rollback extends Component
 
         $commit = validateGitRef($commit, 'rollback commit');
 
-        $deployment_uuid = new Cuid2;
+        $deployment_uuid = new_public_id();
 
         $result = queue_application_deployment(
             application: $this->application,
diff --git a/app/Livewire/Project/Application/Swarm.php b/app/Livewire/Project/Application/Swarm.php
index 197dc41ed..94d627e67 100644
--- a/app/Livewire/Project/Application/Swarm.php
+++ b/app/Livewire/Project/Application/Swarm.php
@@ -3,11 +3,14 @@
 namespace App\Livewire\Project\Application;
 
 use App\Models\Application;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class Swarm extends Component
 {
+    use AuthorizesRequests;
+
     public Application $application;
 
     #[Validate('required')]
@@ -51,6 +54,7 @@ class Swarm extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->application);
             $this->syncData(true);
             $this->dispatch('success', 'Swarm settings updated.');
         } catch (\Throwable $e) {
@@ -61,6 +65,7 @@ class Swarm extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->application);
             $this->syncData(true);
             $this->dispatch('success', 'Swarm settings updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Project/CloneMe.php b/app/Livewire/Project/CloneMe.php
index 644753c83..0a6e3d8ec 100644
--- a/app/Livewire/Project/CloneMe.php
+++ b/app/Livewire/Project/CloneMe.php
@@ -11,11 +11,13 @@ use App\Models\Environment;
 use App\Models\Project;
 use App\Models\Server;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class CloneMe extends Component
 {
+    use AuthorizesRequests;
+
     public string $project_uuid;
 
     public string $environment_uuid;
@@ -61,7 +63,7 @@ class CloneMe extends Component
             ->servers()
             ->get()
             ->reject(fn ($server) => $server->isBuildServer());
-        $this->newName = str($this->project->name.'-clone-'.(string) new Cuid2)->slug();
+        $this->newName = str($this->project->name.'-clone-'.new_public_id())->slug();
     }
 
     public function toggleVolumeCloning(bool $value)
@@ -91,6 +93,7 @@ class CloneMe extends Component
     public function clone(string $type)
     {
         try {
+            $this->authorize('create', Project::class);
             $this->validate([
                 'selectedDestination' => 'required',
                 'newName' => ValidationPatterns::nameRules(),
@@ -108,7 +111,7 @@ class CloneMe extends Component
                 if ($this->environment->name !== 'production') {
                     $project->environments()->create([
                         'name' => $this->environment->name,
-                        'uuid' => (string) new Cuid2,
+                        'uuid' => new_public_id(),
                     ]);
                 }
                 $environment = $project->environments->where('name', $this->environment->name)->first();
@@ -120,7 +123,7 @@ class CloneMe extends Component
                 $project = $this->project;
                 $environment = $this->project->environments()->create([
                     'name' => $this->newName,
-                    'uuid' => (string) new Cuid2,
+                    'uuid' => new_public_id(),
                 ]);
             }
             $applications = $this->environment->applications;
@@ -134,7 +137,7 @@ class CloneMe extends Component
             }
 
             foreach ($databases as $database) {
-                $uuid = (string) new Cuid2;
+                $uuid = new_public_id();
                 $newDatabase = $database->replicate([
                     'id',
                     'created_at',
@@ -225,7 +228,7 @@ class CloneMe extends Component
 
                 $scheduledBackups = $database->scheduledBackups()->get();
                 foreach ($scheduledBackups as $backup) {
-                    $uuid = (string) new Cuid2;
+                    $uuid = new_public_id();
                     $newBackup = $backup->replicate([
                         'id',
                         'created_at',
@@ -254,7 +257,7 @@ class CloneMe extends Component
             }
 
             foreach ($services as $service) {
-                $uuid = (string) new Cuid2;
+                $uuid = new_public_id();
                 $newService = $service->replicate([
                     'id',
                     'created_at',
@@ -278,7 +281,7 @@ class CloneMe extends Component
                         'created_at',
                         'updated_at',
                     ])->fill([
-                        'uuid' => (string) new Cuid2,
+                        'uuid' => new_public_id(),
                         'service_id' => $newService->id,
                         'team_id' => currentTeam()->id,
                     ]);
@@ -409,7 +412,7 @@ class CloneMe extends Component
 
                     $scheduledBackups = $database->scheduledBackups()->get();
                     foreach ($scheduledBackups as $backup) {
-                        $uuid = (string) new Cuid2;
+                        $uuid = new_public_id();
                         $newBackup = $backup->replicate([
                             'id',
                             'created_at',
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index ef106a65f..99426c120 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Database;
 
+use App\Jobs\DatabaseBackupJob;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ServiceDatabase;
 use Exception;
@@ -190,6 +191,18 @@ class BackupEdit extends Component
         }
     }
 
+    public function backupNow()
+    {
+        try {
+            $this->authorize('manageBackups', $this->backup->database);
+
+            DatabaseBackupJob::dispatch($this->backup);
+            $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function instantSave()
     {
         try {
diff --git a/app/Livewire/Project/Database/BackupExecutions.php b/app/Livewire/Project/Database/BackupExecutions.php
index 1dd93781d..41fb1681b 100644
--- a/app/Livewire/Project/Database/BackupExecutions.php
+++ b/app/Livewire/Project/Database/BackupExecutions.php
@@ -3,12 +3,16 @@
 namespace App\Livewire\Project\Database;
 
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ServiceDatabase;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class BackupExecutions extends Component
 {
+    use AuthorizesRequests;
+
     public ?ScheduledDatabaseBackup $backup = null;
 
     public $database;
@@ -44,29 +48,45 @@ class BackupExecutions extends Component
 
     public function cleanupFailed()
     {
-        if ($this->backup) {
-            $this->backup->executions()->where('status', 'failed')->delete();
-            $this->refreshBackupExecutions();
-            $this->dispatch('success', 'Failed backups cleaned up.');
+        try {
+            $this->authorize('manageBackups', $this->database);
+            if ($this->backup) {
+                $this->backup->executions()->where('status', 'failed')->delete();
+                $this->refreshBackupExecutions();
+                $this->dispatch('success', 'Failed backups cleaned up.');
+            }
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
     public function cleanupDeleted()
     {
-        if ($this->backup) {
-            $deletedCount = $this->backup->executions()->where('local_storage_deleted', true)->count();
-            if ($deletedCount > 0) {
-                $this->backup->executions()->where('local_storage_deleted', true)->delete();
-                $this->refreshBackupExecutions();
-                $this->dispatch('success', "Cleaned up {$deletedCount} backup entries deleted from local storage.");
-            } else {
-                $this->dispatch('info', 'No backup entries found that are deleted from local storage.');
+        try {
+            $this->authorize('manageBackups', $this->database);
+            if ($this->backup) {
+                $deletedCount = $this->backup->executions()->where('local_storage_deleted', true)->count();
+                if ($deletedCount > 0) {
+                    $this->backup->executions()->where('local_storage_deleted', true)->delete();
+                    $this->refreshBackupExecutions();
+                    $this->dispatch('success', "Cleaned up {$deletedCount} backup entries deleted from local storage.");
+                } else {
+                    $this->dispatch('info', 'No backup entries found that are deleted from local storage.');
+                }
             }
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
     public function deleteBackup($executionId, $password, $selectedActions = [])
     {
+        try {
+            $this->authorize('manageBackups', $this->database);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+
         if (! verifyPasswordConfirmation($password, $this)) {
             return 'The provided password is incorrect.';
         }
@@ -78,7 +98,7 @@ class BackupExecutions extends Component
             return;
         }
 
-        $server = $execution->scheduledDatabaseBackup->database->getMorphClass() === \App\Models\ServiceDatabase::class
+        $server = $execution->scheduledDatabaseBackup->database->getMorphClass() === ServiceDatabase::class
             ? $execution->scheduledDatabaseBackup->database->service->destination->server
             : $execution->scheduledDatabaseBackup->database->destination->server;
 
@@ -185,7 +205,7 @@ class BackupExecutions extends Component
         if ($this->database) {
             $server = null;
 
-            if ($this->database instanceof \App\Models\ServiceDatabase) {
+            if ($this->database instanceof ServiceDatabase) {
                 $server = $this->database->service->destination->server;
             } elseif ($this->database->destination && $this->database->destination->server) {
                 $server = $this->database->destination->server;
diff --git a/app/Livewire/Project/Database/BackupNow.php b/app/Livewire/Project/Database/BackupNow.php
index decd59a4c..e4ed2a366 100644
--- a/app/Livewire/Project/Database/BackupNow.php
+++ b/app/Livewire/Project/Database/BackupNow.php
@@ -14,9 +14,13 @@ class BackupNow extends Component
 
     public function backupNow()
     {
-        $this->authorize('manageBackups', $this->backup->database);
+        try {
+            $this->authorize('manageBackups', $this->backup->database);
 
-        DatabaseBackupJob::dispatch($this->backup);
-        $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
+            DatabaseBackupJob::dispatch($this->backup);
+            $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 }
diff --git a/app/Livewire/Project/Database/Clickhouse/General.php b/app/Livewire/Project/Database/Clickhouse/General.php
index 694674326..ad5e45b3f 100644
--- a/app/Livewire/Project/Database/Clickhouse/General.php
+++ b/app/Livewire/Project/Database/Clickhouse/General.php
@@ -42,6 +42,8 @@ class General extends Component
 
     public bool $isLogDrainEnabled = false;
 
+    public bool $isPasswordHiddenForMember = false;
+
     public function getListeners(): array
     {
         $user = Auth::user();
@@ -72,6 +74,11 @@ class General extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->clickhouseAdminPassword = '';
+        }
     }
 
     protected function rules(): array
diff --git a/app/Livewire/Project/Database/Dragonfly/General.php b/app/Livewire/Project/Database/Dragonfly/General.php
index f196b9dfb..2f5b84484 100644
--- a/app/Livewire/Project/Database/Dragonfly/General.php
+++ b/app/Livewire/Project/Database/Dragonfly/General.php
@@ -40,6 +40,8 @@ class General extends Component
 
     public bool $isLogDrainEnabled = false;
 
+    public bool $isPasswordHiddenForMember = false;
+
     public function getListeners(): array
     {
         $user = Auth::user();
@@ -70,6 +72,11 @@ class General extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->dragonflyPassword = '';
+        }
     }
 
     protected function rules(): array
diff --git a/app/Livewire/Project/Database/Heading.php b/app/Livewire/Project/Database/Heading.php
index c6c9a3c48..943f22702 100644
--- a/app/Livewire/Project/Database/Heading.php
+++ b/app/Livewire/Project/Database/Heading.php
@@ -90,18 +90,28 @@ class Heading extends Component
 
     public function restart()
     {
-        $this->authorize('manage', $this->database);
+        try {
+            $this->authorize('manage', $this->database);
 
-        $activity = RestartDatabase::run($this->database);
-        $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
+            $activity = RestartDatabase::run($this->database);
+            $this->js("window.dispatchEvent(new CustomEvent('startdatabase'))");
+            $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function start()
     {
-        $this->authorize('manage', $this->database);
+        try {
+            $this->authorize('manage', $this->database);
 
-        $activity = StartDatabase::run($this->database);
-        $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
+            $activity = StartDatabase::run($this->database);
+            $this->js("window.dispatchEvent(new CustomEvent('startdatabase'))");
+            $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function render()
diff --git a/app/Livewire/Project/Database/InitScript.php b/app/Livewire/Project/Database/InitScript.php
index e3baa1c8e..7074c235d 100644
--- a/app/Livewire/Project/Database/InitScript.php
+++ b/app/Livewire/Project/Database/InitScript.php
@@ -2,13 +2,20 @@
 
 namespace App\Livewire\Project\Database;
 
+use App\Models\StandalonePostgresql;
 use Exception;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class InitScript extends Component
 {
+    use AuthorizesRequests;
+
+    #[Locked]
+    public StandalonePostgresql $database;
+
     #[Locked]
     public array $script;
 
@@ -35,6 +42,7 @@ class InitScript extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->database);
             $this->validate();
             $this->script['index'] = $this->index;
             $this->script['content'] = $this->content;
@@ -48,6 +56,7 @@ class InitScript extends Component
     public function delete()
     {
         try {
+            $this->authorize('update', $this->database);
             $this->dispatch('delete_init_script', $this->script);
         } catch (Exception $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Project/Database/Keydb/General.php b/app/Livewire/Project/Database/Keydb/General.php
index 974803e8d..b2d9bce91 100644
--- a/app/Livewire/Project/Database/Keydb/General.php
+++ b/app/Livewire/Project/Database/Keydb/General.php
@@ -42,6 +42,8 @@ class General extends Component
 
     public bool $isLogDrainEnabled = false;
 
+    public bool $isPasswordHiddenForMember = false;
+
     public function getListeners(): array
     {
         $user = Auth::user();
@@ -72,6 +74,11 @@ class General extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->keydbPassword = '';
+        }
     }
 
     protected function rules(): array
diff --git a/app/Livewire/Project/Database/Mariadb/General.php b/app/Livewire/Project/Database/Mariadb/General.php
index 41266f152..61280a34b 100644
--- a/app/Livewire/Project/Database/Mariadb/General.php
+++ b/app/Livewire/Project/Database/Mariadb/General.php
@@ -47,6 +47,8 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected function rules(): array
     {
         return [
@@ -126,6 +128,12 @@ class General extends Component
         } catch (Exception $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->mariadbRootPassword = '';
+            $this->mariadbPassword = '';
+        }
     }
 
     public function syncData(bool $toModel = false)
diff --git a/app/Livewire/Project/Database/Mongodb/General.php b/app/Livewire/Project/Database/Mongodb/General.php
index 7d8249ec4..f68ba82c7 100644
--- a/app/Livewire/Project/Database/Mongodb/General.php
+++ b/app/Livewire/Project/Database/Mongodb/General.php
@@ -45,6 +45,8 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected function rules(): array
     {
         return [
@@ -119,6 +121,11 @@ class General extends Component
         } catch (Exception $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->mongoInitdbRootPassword = '';
+        }
     }
 
     public function syncData(bool $toModel = false)
diff --git a/app/Livewire/Project/Database/Mysql/General.php b/app/Livewire/Project/Database/Mysql/General.php
index 6b88d735d..1adfe2ea7 100644
--- a/app/Livewire/Project/Database/Mysql/General.php
+++ b/app/Livewire/Project/Database/Mysql/General.php
@@ -47,6 +47,8 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected function rules(): array
     {
         return [
@@ -126,6 +128,12 @@ class General extends Component
         } catch (Exception $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->mysqlRootPassword = '';
+            $this->mysqlPassword = '';
+        }
     }
 
     public function syncData(bool $toModel = false)
diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php
index 4e89e8b62..8993cc251 100644
--- a/app/Livewire/Project/Database/Postgresql/General.php
+++ b/app/Livewire/Project/Database/Postgresql/General.php
@@ -55,6 +55,8 @@ class General extends Component
 
     public string $new_content;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected $listeners = [
         'save_init_script',
         'delete_init_script',
@@ -140,6 +142,11 @@ class General extends Component
         } catch (Exception $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->postgresPassword = '';
+        }
     }
 
     public function syncData(bool $toModel = false)
diff --git a/app/Livewire/Project/Database/Redis/General.php b/app/Livewire/Project/Database/Redis/General.php
index aff7b7afa..d431b1506 100644
--- a/app/Livewire/Project/Database/Redis/General.php
+++ b/app/Livewire/Project/Database/Redis/General.php
@@ -45,6 +45,8 @@ class General extends Component
 
     public string $redisVersion;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected $listeners = [
         'envsUpdated' => 'refresh',
     ];
@@ -118,6 +120,11 @@ class General extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->redisPassword = '';
+        }
     }
 
     public function syncData(bool $toModel = false)
diff --git a/app/Livewire/Project/Database/ScheduledBackups.php b/app/Livewire/Project/Database/ScheduledBackups.php
index 1cf5e53f6..9d1f212e4 100644
--- a/app/Livewire/Project/Database/ScheduledBackups.php
+++ b/app/Livewire/Project/Database/ScheduledBackups.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Project\Database;
 
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -34,7 +35,7 @@ class ScheduledBackups extends Component
             $this->setSelectedBackup($this->selectedBackupId, true);
         }
         $this->parameters = get_route_parameters();
-        if ($this->database->getMorphClass() === \App\Models\ServiceDatabase::class) {
+        if ($this->database->getMorphClass() === ServiceDatabase::class) {
             $this->type = 'service-database';
         } else {
             $this->type = 'database';
@@ -56,22 +57,30 @@ class ScheduledBackups extends Component
 
     public function setCustomType()
     {
-        $this->authorize('update', $this->database);
+        try {
+            $this->authorize('update', $this->database);
 
-        $this->database->custom_type = $this->custom_type;
-        $this->database->save();
-        $this->dispatch('success', 'Database type set.');
-        $this->refreshScheduledBackups();
+            $this->database->custom_type = $this->custom_type;
+            $this->database->save();
+            $this->dispatch('success', 'Database type set.');
+            $this->refreshScheduledBackups();
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
     }
 
     public function delete($scheduled_backup_id): void
     {
-        $backup = $this->database->scheduledBackups->find($scheduled_backup_id);
-        $this->authorize('manageBackups', $this->database);
+        try {
+            $this->authorize('manageBackups', $this->database);
 
-        $backup->delete();
-        $this->dispatch('success', 'Scheduled backup deleted.');
-        $this->refreshScheduledBackups();
+            $backup = $this->database->scheduledBackups->find($scheduled_backup_id);
+            $backup->delete();
+            $this->dispatch('success', 'Scheduled backup deleted.');
+            $this->refreshScheduledBackups();
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
     }
 
     public function refreshScheduledBackups(?int $id = null): void
diff --git a/app/Livewire/Project/DeleteEnvironment.php b/app/Livewire/Project/DeleteEnvironment.php
index 4d28c7676..3d7767699 100644
--- a/app/Livewire/Project/DeleteEnvironment.php
+++ b/app/Livewire/Project/DeleteEnvironment.php
@@ -28,18 +28,22 @@ class DeleteEnvironment extends Component
 
     public function delete()
     {
-        $this->validate([
-            'environment_id' => 'required|int',
-        ]);
-        $environment = Environment::ownedByCurrentTeam()->findOrFail($this->environment_id);
-        $this->authorize('delete', $environment);
+        try {
+            $this->validate([
+                'environment_id' => 'required|int',
+            ]);
+            $environment = Environment::ownedByCurrentTeam()->findOrFail($this->environment_id);
+            $this->authorize('delete', $environment);
 
-        if ($environment->isEmpty()) {
-            $environment->delete();
+            if ($environment->isEmpty()) {
+                $environment->delete();
 
-            return redirectRoute($this, 'project.show', ['project_uuid' => $this->parameters['project_uuid']]);
+                return redirectRoute($this, 'project.show', ['project_uuid' => $this->parameters['project_uuid']]);
+            }
+
+            return $this->dispatch('error', "<strong>Environment {$environment->name}</strong> has defined resources, please delete them first.");
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-
-        return $this->dispatch('error', "<strong>Environment {$environment->name}</strong> has defined resources, please delete them first.");
     }
 }
diff --git a/app/Livewire/Project/DeleteProject.php b/app/Livewire/Project/DeleteProject.php
index d95041c2d..598e1f61b 100644
--- a/app/Livewire/Project/DeleteProject.php
+++ b/app/Livewire/Project/DeleteProject.php
@@ -26,18 +26,22 @@ class DeleteProject extends Component
 
     public function delete()
     {
-        $this->validate([
-            'project_id' => 'required|int',
-        ]);
-        $project = Project::ownedByCurrentTeam()->findOrFail($this->project_id);
-        $this->authorize('delete', $project);
+        try {
+            $this->validate([
+                'project_id' => 'required|int',
+            ]);
+            $project = Project::ownedByCurrentTeam()->findOrFail($this->project_id);
+            $this->authorize('delete', $project);
 
-        if ($project->isEmpty()) {
-            $project->delete();
+            if ($project->isEmpty()) {
+                $project->delete();
 
-            return redirectRoute($this, 'project.index');
+                return redirectRoute($this, 'project.index');
+            }
+
+            return $this->dispatch('error', "<strong>Project {$project->name}</strong> has resources defined, please delete them first.");
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-
-        return $this->dispatch('error', "<strong>Project {$project->name}</strong> has resources defined, please delete them first.");
     }
 }
diff --git a/app/Livewire/Project/Edit.php b/app/Livewire/Project/Edit.php
index a2d73eb5f..1314c9e4b 100644
--- a/app/Livewire/Project/Edit.php
+++ b/app/Livewire/Project/Edit.php
@@ -4,10 +4,13 @@ namespace App\Livewire\Project;
 
 use App\Models\Project;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Edit extends Component
 {
+    use AuthorizesRequests;
+
     public Project $project;
 
     public string $name;
@@ -54,6 +57,7 @@ class Edit extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->project);
             $this->syncData(true);
             $this->dispatch('success', 'Project updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Project/EnvironmentEdit.php b/app/Livewire/Project/EnvironmentEdit.php
index 529b9d7b1..9b9a3670d 100644
--- a/app/Livewire/Project/EnvironmentEdit.php
+++ b/app/Livewire/Project/EnvironmentEdit.php
@@ -5,11 +5,14 @@ namespace App\Livewire\Project;
 use App\Models\Application;
 use App\Models\Project;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class EnvironmentEdit extends Component
 {
+    use AuthorizesRequests;
+
     public Project $project;
 
     public Application $application;
@@ -62,6 +65,7 @@ class EnvironmentEdit extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->environment);
             $this->syncData(true);
             redirectRoute($this, 'project.environment.edit', [
                 'environment_uuid' => $this->environment->uuid,
diff --git a/app/Livewire/Project/New/DockerImage.php b/app/Livewire/Project/New/DockerImage.php
index 737806cb8..de86bea4a 100644
--- a/app/Livewire/Project/New/DockerImage.php
+++ b/app/Livewire/Project/New/DockerImage.php
@@ -7,7 +7,6 @@ use App\Models\Project;
 use App\Services\DockerImageParser;
 use App\Support\ValidationPatterns;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class DockerImage extends Component
 {
@@ -130,7 +129,7 @@ class DockerImage extends Component
         $imageTag = $parser->isImageHash() ? 'sha256-'.$parser->getTag() : $parser->getTag();
 
         $application = Application::create([
-            'name' => 'docker-image-'.new Cuid2,
+            'name' => 'docker-image-'.new_public_id(),
             'repository_project_id' => 0,
             'git_repository' => 'coollabsio/coolify',
             'git_branch' => 'main',
diff --git a/app/Livewire/Project/New/EmptyProject.php b/app/Livewire/Project/New/EmptyProject.php
index 0360365a9..7c92ce96b 100644
--- a/app/Livewire/Project/New/EmptyProject.php
+++ b/app/Livewire/Project/New/EmptyProject.php
@@ -4,7 +4,6 @@ namespace App\Livewire\Project\New;
 
 use App\Models\Project;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class EmptyProject extends Component
 {
@@ -13,7 +12,7 @@ class EmptyProject extends Component
         $project = Project::create([
             'name' => generate_random_name(),
             'team_id' => currentTeam()->id,
-            'uuid' => (string) new Cuid2,
+            'uuid' => new_public_id(),
         ]);
 
         return redirectRoute($this, 'project.show', ['project_uuid' => $project->uuid, 'environment_uuid' => $project->environments->first()->uuid]);
diff --git a/app/Livewire/Project/New/SimpleDockerfile.php b/app/Livewire/Project/New/SimpleDockerfile.php
index f07948dba..5a84343fd 100644
--- a/app/Livewire/Project/New/SimpleDockerfile.php
+++ b/app/Livewire/Project/New/SimpleDockerfile.php
@@ -6,7 +6,6 @@ use App\Models\Application;
 use App\Models\GithubApp;
 use App\Models\Project;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class SimpleDockerfile extends Component
 {
@@ -48,7 +47,7 @@ CMD ["nginx", "-g", "daemon off;"]
             $port = 80;
         }
         $application = Application::create([
-            'name' => 'dockerfile-'.new Cuid2,
+            'name' => 'dockerfile-'.new_public_id(),
             'repository_project_id' => 0,
             'git_repository' => 'coollabsio/coolify',
             'git_branch' => 'main',
diff --git a/app/Livewire/Project/Service/EditCompose.php b/app/Livewire/Project/Service/EditCompose.php
index 32cf72067..0f5c739b1 100644
--- a/app/Livewire/Project/Service/EditCompose.php
+++ b/app/Livewire/Project/Service/EditCompose.php
@@ -3,10 +3,13 @@
 namespace App\Livewire\Project\Service;
 
 use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class EditCompose extends Component
 {
+    use AuthorizesRequests;
+
     public Service $service;
 
     public $serviceId;
@@ -72,19 +75,29 @@ class EditCompose extends Component
 
     public function saveEditedCompose()
     {
-        $this->dispatch('info', 'Saving new docker compose...');
-        $this->dispatch('saveCompose', $this->dockerComposeRaw);
-        $this->dispatch('refreshStorages');
+        try {
+            $this->authorize('update', $this->service);
+            $this->dispatch('info', 'Saving new docker compose...');
+            $this->dispatch('saveCompose', $this->dockerComposeRaw);
+            $this->dispatch('refreshStorages');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function instantSave()
     {
-        $this->validate([
-            'isContainerLabelEscapeEnabled' => 'required',
-        ]);
-        $this->syncData(true);
-        $this->service->save(['is_container_label_escape_enabled' => $this->isContainerLabelEscapeEnabled]);
-        $this->dispatch('success', 'Service updated successfully');
+        try {
+            $this->authorize('update', $this->service);
+            $this->validate([
+                'isContainerLabelEscapeEnabled' => 'required',
+            ]);
+            $this->syncData(true);
+            $this->service->save(['is_container_label_escape_enabled' => $this->isContainerLabelEscapeEnabled]);
+            $this->dispatch('success', 'Service updated successfully');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function render()
diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php
index 2f1a229b4..877142d8b 100644
--- a/app/Livewire/Project/Service/FileStorage.php
+++ b/app/Livewire/Project/Service/FileStorage.php
@@ -110,8 +110,7 @@ class FileStorage extends Component
     public function loadStorageOnServer()
     {
         try {
-            // Loading content is a read operation, so we use 'view' permission
-            $this->authorize('view', $this->resource);
+            $this->authorize('update', $this->resource);
 
             $this->fileStorage->loadStorageOnServer();
             $this->syncData();
diff --git a/app/Livewire/Project/Service/Heading.php b/app/Livewire/Project/Service/Heading.php
index 60273ab23..34bb46ff1 100644
--- a/app/Livewire/Project/Service/Heading.php
+++ b/app/Livewire/Project/Service/Heading.php
@@ -110,17 +110,20 @@ class Heading extends Component
 
     public function start()
     {
-        $this->authorizeService('deploy');
-
-        $activity = StartService::run($this->service, pullLatestImages: true);
-        $this->dispatch('activityMonitor', $activity->id);
+        try {
+            $this->authorizeService('deploy');
+            $activity = StartService::run($this->service, pullLatestImages: true);
+            $this->js("window.dispatchEvent(new CustomEvent('startservice'))");
+            $this->dispatch('activityMonitor', $activity->id);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function forceDeploy()
     {
-        $this->authorizeService('deploy');
-
         try {
+            $this->authorizeService('deploy');
             $activities = Activity::where('properties->type_uuid', $this->service->uuid)
                 ->where(function ($q) {
                     $q->where('properties->status', ProcessStatus::IN_PROGRESS->value)
@@ -131,49 +134,57 @@ class Heading extends Component
                 $activity->save();
             }
             $activity = StartService::run($this->service, pullLatestImages: true, stopBeforeStart: true);
+            $this->js("window.dispatchEvent(new CustomEvent('startservice'))");
             $this->dispatch('activityMonitor', $activity->id);
-        } catch (\Exception $e) {
-            $this->dispatch('error', $e->getMessage());
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
     public function stop()
     {
-        $this->authorizeService('stop');
-
         try {
+            $this->authorizeService('stop');
             StopService::dispatch($this->service, false, $this->docker_cleanup);
-        } catch (\Exception $e) {
-            $this->dispatch('error', $e->getMessage());
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
     public function restart()
     {
-        $this->authorizeService('deploy');
+        try {
+            $this->authorizeService('deploy');
+            $this->checkDeployments();
+            if ($this->isDeploymentProgress) {
+                $this->dispatch('error', 'There is a deployment in progress.');
 
-        $this->checkDeployments();
-        if ($this->isDeploymentProgress) {
-            $this->dispatch('error', 'There is a deployment in progress.');
-
-            return;
+                return;
+            }
+            $activity = StartService::run($this->service, stopBeforeStart: true);
+            $this->js("window.dispatchEvent(new CustomEvent('startservice'))");
+            $this->dispatch('activityMonitor', $activity->id);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $activity = StartService::run($this->service, stopBeforeStart: true);
-        $this->dispatch('activityMonitor', $activity->id);
     }
 
     public function pullAndRestartEvent()
     {
-        $this->authorizeService('deploy');
+        try {
+            $this->authorizeService('deploy');
+            $this->checkDeployments();
+            if ($this->isDeploymentProgress) {
+                $this->dispatch('error', 'There is a deployment in progress.');
 
-        $this->checkDeployments();
-        if ($this->isDeploymentProgress) {
-            $this->dispatch('error', 'There is a deployment in progress.');
-
-            return;
+                return;
+            }
+            $activity = StartService::run($this->service, pullLatestImages: true, stopBeforeStart: true);
+            $this->js("window.dispatchEvent(new CustomEvent('startservice'))");
+            $this->dispatch('activityMonitor', $activity->id);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $activity = StartService::run($this->service, pullLatestImages: true, stopBeforeStart: true);
-        $this->dispatch('activityMonitor', $activity->id);
     }
 
     private function authorizeService(string $ability): void
diff --git a/app/Livewire/Project/Service/StackForm.php b/app/Livewire/Project/Service/StackForm.php
index 64a7d8d8b..86d5a57c1 100644
--- a/app/Livewire/Project/Service/StackForm.php
+++ b/app/Livewire/Project/Service/StackForm.php
@@ -4,16 +4,21 @@ namespace App\Livewire\Project\Service;
 
 use App\Models\Service;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
 use Livewire\Component;
 
 class StackForm extends Component
 {
+    use AuthorizesRequests;
+
     public Service $service;
 
     public Collection $fields;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected $listeners = ['saveCompose'];
 
     // Explicit properties
@@ -118,6 +123,17 @@ class StackForm extends Component
         })->flatMap(function ($group) {
             return $group;
         });
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->fields = $this->fields->map(function ($field) {
+                if (data_get($field, 'isPassword')) {
+                    $field['value'] = null;
+                }
+
+                return $field;
+            });
+        }
     }
 
     public function saveCompose($raw)
@@ -128,14 +144,20 @@ class StackForm extends Component
 
     public function instantSave()
     {
-        $this->syncData(true);
-        $this->service->save();
-        $this->dispatch('success', 'Service settings saved.');
+        try {
+            $this->authorize('update', $this->service);
+            $this->syncData(true);
+            $this->service->save();
+            $this->dispatch('success', 'Service settings saved.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function submit($notify = true)
     {
         try {
+            $this->authorize('update', $this->service);
             $this->validate();
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Shared/Danger.php b/app/Livewire/Project/Shared/Danger.php
index caaabc494..7f0d3b173 100644
--- a/app/Livewire/Project/Shared/Danger.php
+++ b/app/Livewire/Project/Shared/Danger.php
@@ -8,7 +8,6 @@ use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Danger extends Component
 {
@@ -39,7 +38,7 @@ class Danger extends Component
     public function mount()
     {
         $parameters = get_route_parameters();
-        $this->modalId = new Cuid2;
+        $this->modalId = new_public_id();
         $this->projectUuid = data_get($parameters, 'project_uuid');
         $this->environmentUuid = data_get($parameters, 'environment_uuid');
 
diff --git a/app/Livewire/Project/Shared/Destination.php b/app/Livewire/Project/Shared/Destination.php
index 715ce82a7..4f3e659da 100644
--- a/app/Livewire/Project/Shared/Destination.php
+++ b/app/Livewire/Project/Shared/Destination.php
@@ -7,12 +7,14 @@ use App\Actions\Docker\GetContainersStatus;
 use App\Events\ApplicationStatusChanged;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Destination extends Component
 {
+    use AuthorizesRequests;
+
     public $resource;
 
     public Collection $networks;
@@ -59,6 +61,7 @@ class Destination extends Component
     public function stop($serverId)
     {
         try {
+            $this->authorize('deploy', $this->resource);
             $server = Server::ownedByCurrentTeam()->findOrFail($serverId);
             StopApplicationOneServer::run($this->resource, $server);
             $this->refreshServers();
@@ -70,12 +73,13 @@ class Destination extends Component
     public function redeploy(int $network_id, int $server_id)
     {
         try {
+            $this->authorize('deploy', $this->resource);
             if ($this->resource->additional_servers->count() > 0 && str($this->resource->docker_registry_image_name)->isEmpty()) {
                 $this->dispatch('error', 'Failed to deploy.', 'Before deploying to multiple servers, you must first set a Docker image in the General tab.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/multiple-servers">documentation</a>');
 
                 return;
             }
-            $deployment_uuid = new Cuid2;
+            $deployment_uuid = new_public_id();
             $server = Server::ownedByCurrentTeam()->findOrFail($server_id);
             $destination = $server->standaloneDockers->where('id', $network_id)->firstOrFail();
             $result = queue_application_deployment(
@@ -128,7 +132,7 @@ class Destination extends Component
             });
             $this->resource->refresh();
             $this->refreshServers();
-        } catch (\Exception $e) {
+        } catch (\Throwable $e) {
             return handleError($e, $this);
         }
     }
@@ -149,7 +153,7 @@ class Destination extends Component
 
             $this->resource->additional_networks()->attach($network->id, ['server_id' => $server->id]);
             $this->dispatch('refresh');
-        } catch (\Exception $e) {
+        } catch (\Throwable $e) {
             return handleError($e, $this);
         }
     }
@@ -157,6 +161,7 @@ class Destination extends Component
     public function removeServer(int $network_id, int $server_id, $password, $selectedActions = [])
     {
         try {
+            $this->authorize('update', $this->resource);
             if (! verifyPasswordConfirmation($password, $this)) {
                 return 'The provided password is incorrect.';
             }
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/All.php b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
index a19837e16..3a5145023 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/All.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
@@ -111,7 +111,7 @@ class All extends Component
             $query->orderBy('order');
         }
 
-        return $query->get();
+        return $this->nullLockedValues($query->get());
     }
 
     private function searchTerm(): string
@@ -127,6 +127,20 @@ class All extends Component
             $this->hardcodedEnvironmentVariablesPreview->isNotEmpty();
     }
 
+    private function nullLockedValues($envs)
+    {
+        $isMember = auth()->user()?->isMember();
+
+        $envs->each(function ($env) use ($isMember) {
+            if ($env->is_shown_once || $isMember) {
+                $env->value = null;
+                $env->real_value = null;
+            }
+        });
+
+        return $envs;
+    }
+
     public function getIsSearchActiveProperty(): bool
     {
         return $this->searchTerm() !== '';
@@ -204,7 +218,12 @@ class All extends Component
 
     private function formatEnvironmentVariables($variables)
     {
-        return $variables->map(function ($item) {
+        $isMember = auth()->user()?->isMember();
+
+        return $variables->map(function ($item) use ($isMember) {
+            if ($isMember) {
+                return "$item->key=(Hidden, only admins can view)";
+            }
             if ($item->is_shown_once) {
                 return "$item->key=(Locked Secret, delete and add again to change)";
             }
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
index 26369852e..094320bdd 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
@@ -61,6 +61,8 @@ class Show extends Component
 
     public bool $is_redis_credential = false;
 
+    public bool $isValueHidden = false;
+
     public array $problematicVariables = [];
 
     protected $listeners = [
@@ -160,6 +162,13 @@ class Show extends Component
             $this->is_really_required = $this->env->is_really_required ?? false;
             $this->is_shared = $this->env->is_shared ?? false;
             $this->real_value = $this->env->real_value;
+
+            if ($this->env->is_shown_once || auth()->user()?->isMember()) {
+                $this->value = null;
+                $this->real_value = null;
+            }
+
+            $this->isValueHidden = auth()->user()?->isMember() ?? false;
         }
     }
 
diff --git a/app/Livewire/Project/Shared/ExecuteContainerCommand.php b/app/Livewire/Project/Shared/ExecuteContainerCommand.php
index 4ea5e12db..3fa063298 100644
--- a/app/Livewire/Project/Shared/ExecuteContainerCommand.php
+++ b/app/Livewire/Project/Shared/ExecuteContainerCommand.php
@@ -6,12 +6,15 @@ use App\Models\Application;
 use App\Models\Server;
 use App\Models\Service;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\On;
 use Livewire\Component;
 
 class ExecuteContainerCommand extends Component
 {
+    use AuthorizesRequests;
+
     public $selected_container = 'default';
 
     public Collection $containers;
@@ -40,6 +43,7 @@ class ExecuteContainerCommand extends Component
         if (data_get($this->parameters, 'application_uuid')) {
             $this->type = 'application';
             $this->resource = Application::ownedByCurrentTeam()->where('uuid', $this->parameters['application_uuid'])->firstOrFail();
+            $this->authorize('view', $this->resource);
             if ($this->resource->destination->server->isFunctional()) {
                 $this->servers = $this->servers->push($this->resource->destination->server);
             }
@@ -56,6 +60,7 @@ class ExecuteContainerCommand extends Component
                 abort(404);
             }
             $this->resource = $resource;
+            $this->authorize('view', $this->resource);
             if ($this->resource->destination->server->isFunctional()) {
                 $this->servers = $this->servers->push($this->resource->destination->server);
             }
@@ -63,6 +68,7 @@ class ExecuteContainerCommand extends Component
         } elseif (data_get($this->parameters, 'service_uuid')) {
             $this->type = 'service';
             $this->resource = Service::ownedByCurrentTeam()->where('uuid', $this->parameters['service_uuid'])->firstOrFail();
+            $this->authorize('view', $this->resource);
             if ($this->resource->server->isFunctional()) {
                 $this->servers = $this->servers->push($this->resource->server);
             }
@@ -70,6 +76,7 @@ class ExecuteContainerCommand extends Component
         } elseif (data_get($this->parameters, 'server_uuid')) {
             $this->type = 'server';
             $this->resource = Server::ownedByCurrentTeam()->where('uuid', $this->parameters['server_uuid'])->firstOrFail();
+            $this->authorize('view', $this->resource);
             $this->servers = $this->servers->push($this->resource);
         }
         $this->servers = $this->servers->sortByDesc(fn ($server) => $server->isTerminalEnabled());
@@ -152,7 +159,9 @@ class ExecuteContainerCommand extends Component
     public function connectToServer()
     {
         try {
+            $this->authorize('canAccessTerminal');
             $server = $this->servers->first();
+            $this->authorize('view', $server);
             if ($server->isForceDisabled()) {
                 throw new \RuntimeException('Server is disabled.');
             }
@@ -181,6 +190,7 @@ class ExecuteContainerCommand extends Component
             return;
         }
         try {
+            $this->authorize('canAccessTerminal');
             // Validate container name format
             if (! ValidationPatterns::isValidContainerName($this->selected_container)) {
                 throw new \InvalidArgumentException('Invalid container name format');
@@ -198,6 +208,8 @@ class ExecuteContainerCommand extends Component
                 throw new \RuntimeException('Invalid server configuration.');
             }
 
+            $this->authorize('view', $server);
+
             if ($server->isForceDisabled()) {
                 throw new \RuntimeException('Server is disabled.');
             }
diff --git a/app/Livewire/Project/Shared/HealthChecks.php b/app/Livewire/Project/Shared/HealthChecks.php
index 195e7fd92..5fa62b04e 100644
--- a/app/Livewire/Project/Shared/HealthChecks.php
+++ b/app/Livewire/Project/Shared/HealthChecks.php
@@ -78,8 +78,12 @@ class HealthChecks extends Component
 
     public function mount()
     {
-        $this->authorize('view', $this->resource);
-        $this->syncData();
+        try {
+            $this->authorize('view', $this->resource);
+            $this->syncData();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function syncData(bool $toModel = false): void
diff --git a/app/Livewire/Project/Shared/ResourceOperations.php b/app/Livewire/Project/Shared/ResourceOperations.php
index 2a8747c33..02171af8d 100644
--- a/app/Livewire/Project/Shared/ResourceOperations.php
+++ b/app/Livewire/Project/Shared/ResourceOperations.php
@@ -22,7 +22,6 @@ use App\Models\StandaloneRedis;
 use App\Models\SwarmDocker;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class ResourceOperations extends Component
 {
@@ -56,224 +55,86 @@ class ResourceOperations extends Component
 
     public function cloneTo($destination_id)
     {
-        $this->authorize('update', $this->resource);
+        try {
+            $this->authorize('update', $this->resource);
 
-        $new_destination = StandaloneDocker::ownedByCurrentTeam()->find($destination_id);
-        if (! $new_destination) {
-            $new_destination = SwarmDocker::ownedByCurrentTeam()->find($destination_id);
-        }
-        if (! $new_destination) {
-            return $this->addError('destination_id', 'Destination not found.');
-        }
-        $uuid = (string) new Cuid2;
-        $server = $new_destination->server;
-
-        if ($this->resource->getMorphClass() === Application::class) {
-            $new_resource = clone_application($this->resource, $new_destination, ['uuid' => $uuid], $this->cloneVolumeData);
-
-            $route = route('project.application.configuration', [
-                'project_uuid' => $this->projectUuid,
-                'environment_uuid' => $this->environmentUuid,
-                'application_uuid' => $new_resource->uuid,
-            ]).'#resource-operations';
-
-            return redirect()->to($route);
-        } elseif (
-            $this->resource->getMorphClass() === StandalonePostgresql::class ||
-            $this->resource->getMorphClass() === StandaloneMongodb::class ||
-            $this->resource->getMorphClass() === StandaloneMysql::class ||
-            $this->resource->getMorphClass() === StandaloneMariadb::class ||
-            $this->resource->getMorphClass() === StandaloneRedis::class ||
-            $this->resource->getMorphClass() === StandaloneKeydb::class ||
-            $this->resource->getMorphClass() === StandaloneDragonfly::class ||
-            $this->resource->getMorphClass() === StandaloneClickhouse::class
-        ) {
-            $uuid = (string) new Cuid2;
-            $new_resource = $this->resource->replicate([
-                'id',
-                'created_at',
-                'updated_at',
-            ])->fill([
-                'uuid' => $uuid,
-                'name' => $this->resource->name.'-clone-'.$uuid,
-                'status' => 'exited',
-                'started_at' => null,
-                'destination_id' => $new_destination->id,
-            ]);
-            $new_resource->save();
-
-            $tags = $this->resource->tags;
-            foreach ($tags as $tag) {
-                $new_resource->tags()->attach($tag->id);
+            $new_destination = StandaloneDocker::ownedByCurrentTeam()->find($destination_id);
+            if (! $new_destination) {
+                $new_destination = SwarmDocker::ownedByCurrentTeam()->find($destination_id);
             }
-
-            $new_resource->persistentStorages()->delete();
-            $persistentVolumes = $this->resource->persistentStorages()->get();
-            foreach ($persistentVolumes as $volume) {
-                $originalName = $volume->name;
-                $newName = '';
-
-                if (str_starts_with($originalName, 'postgres-data-')) {
-                    $newName = 'postgres-data-'.$new_resource->uuid;
-                } elseif (str_starts_with($originalName, 'mysql-data-')) {
-                    $newName = 'mysql-data-'.$new_resource->uuid;
-                } elseif (str_starts_with($originalName, 'redis-data-')) {
-                    $newName = 'redis-data-'.$new_resource->uuid;
-                } elseif (str_starts_with($originalName, 'clickhouse-data-')) {
-                    $newName = 'clickhouse-data-'.$new_resource->uuid;
-                } elseif (str_starts_with($originalName, 'mariadb-data-')) {
-                    $newName = 'mariadb-data-'.$new_resource->uuid;
-                } elseif (str_starts_with($originalName, 'mongodb-data-')) {
-                    $newName = 'mongodb-data-'.$new_resource->uuid;
-                } elseif (str_starts_with($originalName, 'keydb-data-')) {
-                    $newName = 'keydb-data-'.$new_resource->uuid;
-                } elseif (str_starts_with($originalName, 'dragonfly-data-')) {
-                    $newName = 'dragonfly-data-'.$new_resource->uuid;
-                } else {
-                    if (str_starts_with($volume->name, $this->resource->uuid)) {
-                        $newName = str($volume->name)->replace($this->resource->uuid, $new_resource->uuid);
-                    } else {
-                        $newName = $new_resource->uuid.'-'.$volume->name;
-                    }
-                }
-
-                $newPersistentVolume = $volume->replicate([
-                    'id',
-                    'created_at',
-                    'updated_at',
-                    'uuid',
-                ])->fill([
-                    'name' => $newName,
-                    'resource_id' => $new_resource->id,
-                ]);
-                $newPersistentVolume->save();
-
-                if ($this->cloneVolumeData) {
-                    try {
-                        StopDatabase::dispatch($this->resource);
-                        $sourceVolume = $volume->name;
-                        $targetVolume = $newPersistentVolume->name;
-                        $sourceServer = $this->resource->destination->server;
-                        $targetServer = $new_resource->destination->server;
-
-                        VolumeCloneJob::dispatch($sourceVolume, $targetVolume, $sourceServer, $targetServer, $newPersistentVolume);
-
-                        StartDatabase::dispatch($this->resource);
-                    } catch (\Exception $e) {
-                        \Log::error('Failed to copy volume data for '.$volume->name.': '.$e->getMessage());
-                    }
-                }
+            if (! $new_destination) {
+                return $this->addError('destination_id', 'Destination not found.');
             }
+            $uuid = new_public_id();
+            $server = $new_destination->server;
 
-            $fileStorages = $this->resource->fileStorages()->get();
-            foreach ($fileStorages as $storage) {
-                $newStorage = $storage->replicate([
-                    'id',
-                    'created_at',
-                    'updated_at',
-                ])->fill([
-                    'resource_id' => $new_resource->id,
-                ]);
-                $newStorage->save();
-            }
+            if ($this->resource->getMorphClass() === Application::class) {
+                $new_resource = clone_application($this->resource, $new_destination, ['uuid' => $uuid], $this->cloneVolumeData);
 
-            $scheduledBackups = $this->resource->scheduledBackups()->get();
-            foreach ($scheduledBackups as $backup) {
-                $uuid = (string) new Cuid2;
-                $newBackup = $backup->replicate([
+                $route = route('project.application.configuration', [
+                    'project_uuid' => $this->projectUuid,
+                    'environment_uuid' => $this->environmentUuid,
+                    'application_uuid' => $new_resource->uuid,
+                ]).'#resource-operations';
+
+                return redirect()->to($route);
+            } elseif (
+                $this->resource->getMorphClass() === StandalonePostgresql::class ||
+                $this->resource->getMorphClass() === StandaloneMongodb::class ||
+                $this->resource->getMorphClass() === StandaloneMysql::class ||
+                $this->resource->getMorphClass() === StandaloneMariadb::class ||
+                $this->resource->getMorphClass() === StandaloneRedis::class ||
+                $this->resource->getMorphClass() === StandaloneKeydb::class ||
+                $this->resource->getMorphClass() === StandaloneDragonfly::class ||
+                $this->resource->getMorphClass() === StandaloneClickhouse::class
+            ) {
+                $uuid = new_public_id();
+                $new_resource = $this->resource->replicate([
                     'id',
                     'created_at',
                     'updated_at',
                 ])->fill([
                     'uuid' => $uuid,
-                    'database_id' => $new_resource->id,
-                    'database_type' => $new_resource->getMorphClass(),
-                    'team_id' => currentTeam()->id,
-                ]);
-                $newBackup->save();
-            }
-
-            $environmentVaribles = $this->resource->environment_variables()->get();
-            foreach ($environmentVaribles as $environmentVarible) {
-                $payload = [
-                    'resourceable_id' => $new_resource->id,
-                    'resourceable_type' => $new_resource->getMorphClass(),
-                ];
-                $newEnvironmentVariable = $environmentVarible->replicate([
-                    'id',
-                    'created_at',
-                    'updated_at',
-                ])->fill($payload);
-                $newEnvironmentVariable->save();
-            }
-
-            $route = route('project.database.configuration', [
-                'project_uuid' => $this->projectUuid,
-                'environment_uuid' => $this->environmentUuid,
-                'database_uuid' => $new_resource->uuid,
-            ]).'#resource-operations';
-
-            return redirect()->to($route);
-        } elseif ($this->resource->type() === 'service') {
-            $uuid = (string) new Cuid2;
-            $new_resource = $this->resource->replicate([
-                'id',
-                'created_at',
-                'updated_at',
-            ])->fill([
-                'uuid' => $uuid,
-                'name' => $this->resource->name.'-clone-'.$uuid,
-                'destination_id' => $new_destination->id,
-                'destination_type' => $new_destination->getMorphClass(),
-                'server_id' => $new_destination->server_id, // server_id is probably not needed anymore because of the new polymorphic relationships (here it is needed for clone to a different server to work - but maybe we can drop the column)
-            ]);
-
-            $new_resource->save();
-
-            $tags = $this->resource->tags;
-            foreach ($tags as $tag) {
-                $new_resource->tags()->attach($tag->id);
-            }
-
-            $scheduledTasks = $this->resource->scheduled_tasks()->get();
-            foreach ($scheduledTasks as $task) {
-                $newTask = $task->replicate([
-                    'id',
-                    'created_at',
-                    'updated_at',
-                ])->fill([
-                    'uuid' => (string) new Cuid2,
-                    'service_id' => $new_resource->id,
-                    'team_id' => currentTeam()->id,
-                ]);
-                $newTask->save();
-            }
-
-            $environmentVariables = $this->resource->environment_variables()->get();
-            foreach ($environmentVariables as $environmentVariable) {
-                $newEnvironmentVariable = $environmentVariable->replicate([
-                    'id',
-                    'created_at',
-                    'updated_at',
-                ])->fill([
-                    'resourceable_id' => $new_resource->id,
-                    'resourceable_type' => $new_resource->getMorphClass(),
-                ]);
-                $newEnvironmentVariable->save();
-            }
-
-            foreach ($new_resource->applications() as $application) {
-                $application->fill([
+                    'name' => $this->resource->name.'-clone-'.$uuid,
                     'status' => 'exited',
-                ])->save();
+                    'started_at' => null,
+                    'destination_id' => $new_destination->id,
+                ]);
+                $new_resource->save();
 
-                $persistentVolumes = $application->persistentStorages()->get();
+                $tags = $this->resource->tags;
+                foreach ($tags as $tag) {
+                    $new_resource->tags()->attach($tag->id);
+                }
+
+                $new_resource->persistentStorages()->delete();
+                $persistentVolumes = $this->resource->persistentStorages()->get();
                 foreach ($persistentVolumes as $volume) {
+                    $originalName = $volume->name;
                     $newName = '';
-                    if (str_starts_with($volume->name, $volume->resource->uuid)) {
-                        $newName = str($volume->name)->replace($volume->resource->uuid, $application->uuid);
+
+                    if (str_starts_with($originalName, 'postgres-data-')) {
+                        $newName = 'postgres-data-'.$new_resource->uuid;
+                    } elseif (str_starts_with($originalName, 'mysql-data-')) {
+                        $newName = 'mysql-data-'.$new_resource->uuid;
+                    } elseif (str_starts_with($originalName, 'redis-data-')) {
+                        $newName = 'redis-data-'.$new_resource->uuid;
+                    } elseif (str_starts_with($originalName, 'clickhouse-data-')) {
+                        $newName = 'clickhouse-data-'.$new_resource->uuid;
+                    } elseif (str_starts_with($originalName, 'mariadb-data-')) {
+                        $newName = 'mariadb-data-'.$new_resource->uuid;
+                    } elseif (str_starts_with($originalName, 'mongodb-data-')) {
+                        $newName = 'mongodb-data-'.$new_resource->uuid;
+                    } elseif (str_starts_with($originalName, 'keydb-data-')) {
+                        $newName = 'keydb-data-'.$new_resource->uuid;
+                    } elseif (str_starts_with($originalName, 'dragonfly-data-')) {
+                        $newName = 'dragonfly-data-'.$new_resource->uuid;
                     } else {
-                        $newName = $application->uuid.'-'.str($volume->name)->afterLast('-');
+                        if (str_starts_with($volume->name, $this->resource->uuid)) {
+                            $newName = str($volume->name)->replace($this->resource->uuid, $new_resource->uuid);
+                        } else {
+                            $newName = $new_resource->uuid.'-'.$volume->name;
+                        }
                     }
 
                     $newPersistentVolume = $volume->replicate([
@@ -283,80 +144,222 @@ class ResourceOperations extends Component
                         'uuid',
                     ])->fill([
                         'name' => $newName,
-                        'resource_id' => $application->id,
+                        'resource_id' => $new_resource->id,
                     ]);
                     $newPersistentVolume->save();
 
                     if ($this->cloneVolumeData) {
                         try {
-                            StopService::dispatch($application);
+                            StopDatabase::dispatch($this->resource);
                             $sourceVolume = $volume->name;
                             $targetVolume = $newPersistentVolume->name;
-                            $sourceServer = $application->service->destination->server;
+                            $sourceServer = $this->resource->destination->server;
                             $targetServer = $new_resource->destination->server;
 
                             VolumeCloneJob::dispatch($sourceVolume, $targetVolume, $sourceServer, $targetServer, $newPersistentVolume);
 
-                            StartService::dispatch($application);
+                            StartDatabase::dispatch($this->resource);
                         } catch (\Exception $e) {
                             \Log::error('Failed to copy volume data for '.$volume->name.': '.$e->getMessage());
                         }
                     }
                 }
-            }
 
-            foreach ($new_resource->databases() as $database) {
-                $database->fill([
-                    'status' => 'exited',
-                ])->save();
-
-                $persistentVolumes = $database->persistentStorages()->get();
-                foreach ($persistentVolumes as $volume) {
-                    $newName = '';
-                    if (str_starts_with($volume->name, $volume->resource->uuid)) {
-                        $newName = str($volume->name)->replace($volume->resource->uuid, $database->uuid);
-                    } else {
-                        $newName = $database->uuid.'-'.str($volume->name)->afterLast('-');
-                    }
-
-                    $newPersistentVolume = $volume->replicate([
+                $fileStorages = $this->resource->fileStorages()->get();
+                foreach ($fileStorages as $storage) {
+                    $newStorage = $storage->replicate([
                         'id',
                         'created_at',
                         'updated_at',
-                        'uuid',
                     ])->fill([
-                        'name' => $newName,
-                        'resource_id' => $database->id,
+                        'resource_id' => $new_resource->id,
                     ]);
-                    $newPersistentVolume->save();
+                    $newStorage->save();
+                }
 
-                    if ($this->cloneVolumeData) {
-                        try {
-                            StopService::dispatch($database->service);
-                            $sourceVolume = $volume->name;
-                            $targetVolume = $newPersistentVolume->name;
-                            $sourceServer = $database->service->destination->server;
-                            $targetServer = $new_resource->destination->server;
+                $scheduledBackups = $this->resource->scheduledBackups()->get();
+                foreach ($scheduledBackups as $backup) {
+                    $uuid = new_public_id();
+                    $newBackup = $backup->replicate([
+                        'id',
+                        'created_at',
+                        'updated_at',
+                    ])->fill([
+                        'uuid' => $uuid,
+                        'database_id' => $new_resource->id,
+                        'database_type' => $new_resource->getMorphClass(),
+                        'team_id' => currentTeam()->id,
+                    ]);
+                    $newBackup->save();
+                }
 
-                            VolumeCloneJob::dispatch($sourceVolume, $targetVolume, $sourceServer, $targetServer, $newPersistentVolume);
+                $environmentVaribles = $this->resource->environment_variables()->get();
+                foreach ($environmentVaribles as $environmentVarible) {
+                    $payload = [
+                        'resourceable_id' => $new_resource->id,
+                        'resourceable_type' => $new_resource->getMorphClass(),
+                    ];
+                    $newEnvironmentVariable = $environmentVarible->replicate([
+                        'id',
+                        'created_at',
+                        'updated_at',
+                    ])->fill($payload);
+                    $newEnvironmentVariable->save();
+                }
 
-                            StartService::dispatch($database->service);
-                        } catch (\Exception $e) {
-                            \Log::error('Failed to copy volume data for '.$volume->name.': '.$e->getMessage());
+                $route = route('project.database.configuration', [
+                    'project_uuid' => $this->projectUuid,
+                    'environment_uuid' => $this->environmentUuid,
+                    'database_uuid' => $new_resource->uuid,
+                ]).'#resource-operations';
+
+                return redirect()->to($route);
+            } elseif ($this->resource->type() === 'service') {
+                $uuid = new_public_id();
+                $new_resource = $this->resource->replicate([
+                    'id',
+                    'created_at',
+                    'updated_at',
+                ])->fill([
+                    'uuid' => $uuid,
+                    'name' => $this->resource->name.'-clone-'.$uuid,
+                    'destination_id' => $new_destination->id,
+                    'destination_type' => $new_destination->getMorphClass(),
+                    'server_id' => $new_destination->server_id,
+                ]);
+
+                $new_resource->save();
+
+                $tags = $this->resource->tags;
+                foreach ($tags as $tag) {
+                    $new_resource->tags()->attach($tag->id);
+                }
+
+                $scheduledTasks = $this->resource->scheduled_tasks()->get();
+                foreach ($scheduledTasks as $task) {
+                    $newTask = $task->replicate([
+                        'id',
+                        'created_at',
+                        'updated_at',
+                    ])->fill([
+                        'uuid' => new_public_id(),
+                        'service_id' => $new_resource->id,
+                        'team_id' => currentTeam()->id,
+                    ]);
+                    $newTask->save();
+                }
+
+                $environmentVariables = $this->resource->environment_variables()->get();
+                foreach ($environmentVariables as $environmentVariable) {
+                    $newEnvironmentVariable = $environmentVariable->replicate([
+                        'id',
+                        'created_at',
+                        'updated_at',
+                    ])->fill([
+                        'resourceable_id' => $new_resource->id,
+                        'resourceable_type' => $new_resource->getMorphClass(),
+                    ]);
+                    $newEnvironmentVariable->save();
+                }
+
+                foreach ($new_resource->applications() as $application) {
+                    $application->fill([
+                        'status' => 'exited',
+                    ])->save();
+
+                    $persistentVolumes = $application->persistentStorages()->get();
+                    foreach ($persistentVolumes as $volume) {
+                        $newName = '';
+                        if (str_starts_with($volume->name, $volume->resource->uuid)) {
+                            $newName = str($volume->name)->replace($volume->resource->uuid, $application->uuid);
+                        } else {
+                            $newName = $application->uuid.'-'.str($volume->name)->afterLast('-');
+                        }
+
+                        $newPersistentVolume = $volume->replicate([
+                            'id',
+                            'created_at',
+                            'updated_at',
+                            'uuid',
+                        ])->fill([
+                            'name' => $newName,
+                            'resource_id' => $application->id,
+                        ]);
+                        $newPersistentVolume->save();
+
+                        if ($this->cloneVolumeData) {
+                            try {
+                                StopService::dispatch($application);
+                                $sourceVolume = $volume->name;
+                                $targetVolume = $newPersistentVolume->name;
+                                $sourceServer = $application->service->destination->server;
+                                $targetServer = $new_resource->destination->server;
+
+                                VolumeCloneJob::dispatch($sourceVolume, $targetVolume, $sourceServer, $targetServer, $newPersistentVolume);
+
+                                StartService::dispatch($application);
+                            } catch (\Exception $e) {
+                                \Log::error('Failed to copy volume data for '.$volume->name.': '.$e->getMessage());
+                            }
                         }
                     }
                 }
+
+                foreach ($new_resource->databases() as $database) {
+                    $database->fill([
+                        'status' => 'exited',
+                    ])->save();
+
+                    $persistentVolumes = $database->persistentStorages()->get();
+                    foreach ($persistentVolumes as $volume) {
+                        $newName = '';
+                        if (str_starts_with($volume->name, $volume->resource->uuid)) {
+                            $newName = str($volume->name)->replace($volume->resource->uuid, $database->uuid);
+                        } else {
+                            $newName = $database->uuid.'-'.str($volume->name)->afterLast('-');
+                        }
+
+                        $newPersistentVolume = $volume->replicate([
+                            'id',
+                            'created_at',
+                            'updated_at',
+                            'uuid',
+                        ])->fill([
+                            'name' => $newName,
+                            'resource_id' => $database->id,
+                        ]);
+                        $newPersistentVolume->save();
+
+                        if ($this->cloneVolumeData) {
+                            try {
+                                StopService::dispatch($database->service);
+                                $sourceVolume = $volume->name;
+                                $targetVolume = $newPersistentVolume->name;
+                                $sourceServer = $database->service->destination->server;
+                                $targetServer = $new_resource->destination->server;
+
+                                VolumeCloneJob::dispatch($sourceVolume, $targetVolume, $sourceServer, $targetServer, $newPersistentVolume);
+
+                                StartService::dispatch($database->service);
+                            } catch (\Exception $e) {
+                                \Log::error('Failed to copy volume data for '.$volume->name.': '.$e->getMessage());
+                            }
+                        }
+                    }
+                }
+
+                $new_resource->parse();
+
+                $route = route('project.service.configuration', [
+                    'project_uuid' => $this->projectUuid,
+                    'environment_uuid' => $this->environmentUuid,
+                    'service_uuid' => $new_resource->uuid,
+                ]).'#resource-operations';
+
+                return redirect()->to($route);
             }
-
-            $new_resource->parse();
-
-            $route = route('project.service.configuration', [
-                'project_uuid' => $this->projectUuid,
-                'environment_uuid' => $this->environmentUuid,
-                'service_uuid' => $new_resource->uuid,
-            ]).'#resource-operations';
-
-            return redirect()->to($route);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
diff --git a/app/Livewire/Project/Shared/Terminal.php b/app/Livewire/Project/Shared/Terminal.php
index db65cdaad..46c75e352 100644
--- a/app/Livewire/Project/Shared/Terminal.php
+++ b/app/Livewire/Project/Shared/Terminal.php
@@ -5,11 +5,14 @@ namespace App\Livewire\Project\Shared;
 use App\Helpers\SshMultiplexingHelper;
 use App\Models\Server;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\On;
 use Livewire\Component;
 
 class Terminal extends Component
 {
+    use AuthorizesRequests;
+
     public bool $hasShell = true;
 
     public bool $isTerminalConnected = false;
@@ -32,7 +35,11 @@ class Terminal extends Component
     #[On('send-terminal-command')]
     public function sendTerminalCommand($isContainer, $identifier, $serverUuid)
     {
+        $this->authorize('canAccessTerminal');
+
         $server = Server::ownedByCurrentTeam()->whereUuid($serverUuid)->firstOrFail();
+        $this->authorize('view', $server);
+
         if (! $server->isTerminalEnabled() || $server->isForceDisabled()) {
             abort(403, 'Terminal access is disabled on this server.');
         }
diff --git a/app/Livewire/Project/Shared/UploadConfig.php b/app/Livewire/Project/Shared/UploadConfig.php
index 1b10f588b..0f0894687 100644
--- a/app/Livewire/Project/Shared/UploadConfig.php
+++ b/app/Livewire/Project/Shared/UploadConfig.php
@@ -3,10 +3,13 @@
 namespace App\Livewire\Project\Shared;
 
 use App\Models\Application;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class UploadConfig extends Component
 {
+    use AuthorizesRequests;
+
     public $config;
 
     public $applicationId;
@@ -29,13 +32,12 @@ class UploadConfig extends Component
     public function uploadConfig()
     {
         try {
-            $application = Application::findOrFail($this->applicationId);
+            $application = Application::ownedByCurrentTeam()->findOrFail($this->applicationId);
+            $this->authorize('update', $application);
             $application->setConfig($this->config);
             $this->dispatch('success', 'Application settings updated');
-        } catch (\Exception $e) {
-            $this->dispatch('error', $e->getMessage());
-
-            return;
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
diff --git a/app/Livewire/Project/Shared/Webhooks.php b/app/Livewire/Project/Shared/Webhooks.php
index eafc653d5..eb90262e9 100644
--- a/app/Livewire/Project/Shared/Webhooks.php
+++ b/app/Livewire/Project/Shared/Webhooks.php
@@ -34,19 +34,24 @@ class Webhooks extends Component
     {
         $this->deploywebhook = generateDeployWebhook($this->resource);
 
-        $this->githubManualWebhookSecret = data_get($this->resource, 'manual_webhook_secret_github');
+        if ($this->canViewSecrets()) {
+            $this->githubManualWebhookSecret = data_get($this->resource, 'manual_webhook_secret_github');
+            $this->gitlabManualWebhookSecret = data_get($this->resource, 'manual_webhook_secret_gitlab');
+            $this->bitbucketManualWebhookSecret = data_get($this->resource, 'manual_webhook_secret_bitbucket');
+            $this->giteaManualWebhookSecret = data_get($this->resource, 'manual_webhook_secret_gitea');
+        }
+
         $this->githubManualWebhook = generateGitManualWebhook($this->resource, 'github');
-
-        $this->gitlabManualWebhookSecret = data_get($this->resource, 'manual_webhook_secret_gitlab');
         $this->gitlabManualWebhook = generateGitManualWebhook($this->resource, 'gitlab');
-
-        $this->bitbucketManualWebhookSecret = data_get($this->resource, 'manual_webhook_secret_bitbucket');
         $this->bitbucketManualWebhook = generateGitManualWebhook($this->resource, 'bitbucket');
-
-        $this->giteaManualWebhookSecret = data_get($this->resource, 'manual_webhook_secret_gitea');
         $this->giteaManualWebhook = generateGitManualWebhook($this->resource, 'gitea');
     }
 
+    public function canViewSecrets(): bool
+    {
+        return auth()->user()->can('update', $this->resource);
+    }
+
     public function submit()
     {
         try {
diff --git a/app/Livewire/Project/Show.php b/app/Livewire/Project/Show.php
index e884abb4e..fc84e4fbd 100644
--- a/app/Livewire/Project/Show.php
+++ b/app/Livewire/Project/Show.php
@@ -5,11 +5,13 @@ namespace App\Livewire\Project;
 use App\Models\Environment;
 use App\Models\Project;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Show extends Component
 {
+    use AuthorizesRequests;
+
     public Project $project;
 
     public string $name;
@@ -41,11 +43,12 @@ class Show extends Component
     public function submit()
     {
         try {
+            $this->authorize('create', Environment::class);
             $this->validate();
             $environment = Environment::create([
                 'name' => $this->name,
                 'project_id' => $this->project->id,
-                'uuid' => (string) new Cuid2,
+                'uuid' => new_public_id(),
             ]);
 
             return redirectRoute($this, 'project.resource.index', [
diff --git a/app/Livewire/Security/ApiTokens.php b/app/Livewire/Security/ApiTokens.php
index c275ec097..bf201e257 100644
--- a/app/Livewire/Security/ApiTokens.php
+++ b/app/Livewire/Security/ApiTokens.php
@@ -36,6 +36,12 @@ class ApiTokens extends Component
     #[Locked]
     public bool $canUseWritePermissions = false;
 
+    #[Locked]
+    public bool $canUseDeployPermissions = false;
+
+    #[Locked]
+    public bool $canUseSensitivePermissions = false;
+
     public function render()
     {
         return view('livewire.security.api-tokens');
@@ -46,6 +52,8 @@ class ApiTokens extends Component
         $this->isApiEnabled = InstanceSettings::get()->is_api_enabled;
         $this->canUseRootPermissions = auth()->user()->can('useRootPermissions', PersonalAccessToken::class);
         $this->canUseWritePermissions = auth()->user()->can('useWritePermissions', PersonalAccessToken::class);
+        $this->canUseDeployPermissions = auth()->user()->can('useDeployPermissions', PersonalAccessToken::class);
+        $this->canUseSensitivePermissions = auth()->user()->can('useSensitivePermissions', PersonalAccessToken::class);
         $this->getTokens();
     }
 
@@ -56,10 +64,9 @@ class ApiTokens extends Component
 
     public function updatedPermissions($permissionToUpdate)
     {
-        // Check if user is trying to use restricted permissions
+        // Re-evaluate policies fresh — never trust stored snapshot booleans.
         if ($permissionToUpdate == 'root' && ! auth()->user()->can('useRootPermissions', PersonalAccessToken::class)) {
             $this->dispatch('error', 'You do not have permission to use root permissions.');
-            // Remove root from permissions if it was somehow added
             $this->permissions = array_diff($this->permissions, ['root']);
 
             return;
@@ -67,12 +74,25 @@ class ApiTokens extends Component
 
         if (in_array($permissionToUpdate, ['write', 'write:sensitive'], true) && ! auth()->user()->can('useWritePermissions', PersonalAccessToken::class)) {
             $this->dispatch('error', 'You do not have permission to use write permissions.');
-            // Remove write permissions if they were somehow added
             $this->permissions = array_diff($this->permissions, ['write', 'write:sensitive']);
 
             return;
         }
 
+        if ($permissionToUpdate == 'deploy' && ! auth()->user()->can('useDeployPermissions', PersonalAccessToken::class)) {
+            $this->dispatch('error', 'You do not have permission to use deploy permissions.');
+            $this->permissions = array_diff($this->permissions, ['deploy']);
+
+            return;
+        }
+
+        if ($permissionToUpdate == 'read:sensitive' && ! auth()->user()->can('useSensitivePermissions', PersonalAccessToken::class)) {
+            $this->dispatch('error', 'You do not have permission to use read:sensitive permissions.');
+            $this->permissions = array_diff($this->permissions, ['read:sensitive']);
+
+            return;
+        }
+
         if ($permissionToUpdate == 'root') {
             $this->permissions = ['root'];
         } elseif ($permissionToUpdate == 'read:sensitive' && ! in_array('read', $this->permissions, true)) {
@@ -92,7 +112,9 @@ class ApiTokens extends Component
         try {
             $this->authorize('create', PersonalAccessToken::class);
 
-            // Validate permissions based on user role
+            // Re-evaluate policies fresh against the current authenticated user.
+            // Never trust $this->canUse* booleans — they come from the Livewire
+            // snapshot which can be replayed from another user's session.
             if (in_array('root', $this->permissions, true) && ! auth()->user()->can('useRootPermissions', PersonalAccessToken::class)) {
                 throw new \Exception('You do not have permission to create tokens with root permissions.');
             }
@@ -101,6 +123,14 @@ class ApiTokens extends Component
                 throw new \Exception('You do not have permission to create tokens with write permissions.');
             }
 
+            if (in_array('deploy', $this->permissions, true) && ! auth()->user()->can('useDeployPermissions', PersonalAccessToken::class)) {
+                throw new \Exception('You do not have permission to create tokens with deploy permissions.');
+            }
+
+            if (in_array('read:sensitive', $this->permissions, true) && ! auth()->user()->can('useSensitivePermissions', PersonalAccessToken::class)) {
+                throw new \Exception('You do not have permission to create tokens with read:sensitive permissions.');
+            }
+
             $this->validate([
                 'description' => 'required|min:3|max:255',
                 'expiresInDays' => 'nullable|integer|in:7,30,60,90,365',
@@ -108,6 +138,7 @@ class ApiTokens extends Component
             $expiresAt = $this->expiresInDays ? now()->addDays($this->expiresInDays) : null;
             $token = auth()->user()->createToken($this->description, array_values($this->permissions), $expiresAt);
             $this->getTokens();
+            // Do NOT strip the numeric prefix (e.g. "69|...") — Sanctum uses it to index and look up tokens.
             session()->flash('token', $token->plainTextToken);
         } catch (\Exception $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Security/CloudInitScriptForm.php b/app/Livewire/Security/CloudInitScriptForm.php
index 33beff334..c7f933d39 100644
--- a/app/Livewire/Security/CloudInitScriptForm.php
+++ b/app/Livewire/Security/CloudInitScriptForm.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Security;
 
 use App\Models\CloudInitScript;
+use App\Rules\ValidCloudInitYaml;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -20,15 +21,19 @@ class CloudInitScriptForm extends Component
 
     public function mount(?int $scriptId = null)
     {
-        if ($scriptId) {
-            $this->scriptId = $scriptId;
-            $cloudInitScript = CloudInitScript::ownedByCurrentTeam()->findOrFail($scriptId);
-            $this->authorize('update', $cloudInitScript);
+        try {
+            if ($scriptId) {
+                $this->scriptId = $scriptId;
+                $cloudInitScript = CloudInitScript::ownedByCurrentTeam()->findOrFail($scriptId);
+                $this->authorize('update', $cloudInitScript);
 
-            $this->name = $cloudInitScript->name;
-            $this->script = $cloudInitScript->script;
-        } else {
-            $this->authorize('create', CloudInitScript::class);
+                $this->name = $cloudInitScript->name;
+                $this->script = $cloudInitScript->script;
+            } else {
+                $this->authorize('create', CloudInitScript::class);
+            }
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
@@ -36,7 +41,7 @@ class CloudInitScriptForm extends Component
     {
         return [
             'name' => 'required|string|max:255',
-            'script' => ['required', 'string', new \App\Rules\ValidCloudInitYaml],
+            'script' => ['required', 'string', new ValidCloudInitYaml],
         ];
     }
 
@@ -64,17 +69,29 @@ class CloudInitScriptForm extends Component
                     'script' => $this->script,
                 ]);
 
+                auditLog('ui.cloud_init_script.updated', [
+                    'team_id' => currentTeam()->id,
+                    'cloud_init_script_id' => $cloudInitScript->id,
+                    'cloud_init_script_name' => $cloudInitScript->name,
+                ]);
+
                 $message = 'Cloud-init script updated successfully.';
             } else {
                 // Create new script
                 $this->authorize('create', CloudInitScript::class);
 
-                CloudInitScript::create([
+                $cloudInitScript = CloudInitScript::create([
                     'team_id' => currentTeam()->id,
                     'name' => $this->name,
                     'script' => $this->script,
                 ]);
 
+                auditLog('ui.cloud_init_script.created', [
+                    'team_id' => currentTeam()->id,
+                    'cloud_init_script_id' => $cloudInitScript->id,
+                    'cloud_init_script_name' => $cloudInitScript->name,
+                ]);
+
                 $message = 'Cloud-init script created successfully.';
             }
 
diff --git a/app/Livewire/Security/CloudInitScripts.php b/app/Livewire/Security/CloudInitScripts.php
index 13bcf2caa..57b7324d3 100644
--- a/app/Livewire/Security/CloudInitScripts.php
+++ b/app/Livewire/Security/CloudInitScripts.php
@@ -36,9 +36,16 @@ class CloudInitScripts extends Component
             $script = CloudInitScript::ownedByCurrentTeam()->findOrFail($scriptId);
             $this->authorize('delete', $script);
 
+            $scriptName = $script->name;
             $script->delete();
             $this->loadScripts();
 
+            auditLog('ui.cloud_init_script.deleted', [
+                'team_id' => currentTeam()->id,
+                'cloud_init_script_id' => $scriptId,
+                'cloud_init_script_name' => $scriptName,
+            ]);
+
             $this->dispatch('success', 'Cloud-init script deleted successfully.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Security/CloudProviderTokenForm.php b/app/Livewire/Security/CloudProviderTokenForm.php
index 7affb1531..6d0efa15f 100644
--- a/app/Livewire/Security/CloudProviderTokenForm.php
+++ b/app/Livewire/Security/CloudProviderTokenForm.php
@@ -21,7 +21,11 @@ class CloudProviderTokenForm extends Component
 
     public function mount()
     {
-        $this->authorize('create', CloudProviderToken::class);
+        try {
+            $this->authorize('create', CloudProviderToken::class);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     protected function rules(): array
@@ -50,7 +54,6 @@ class CloudProviderTokenForm extends Component
                 $response = Http::withHeaders([
                     'Authorization' => 'Bearer '.$token,
                 ])->timeout(10)->get('https://api.hetzner.cloud/v1/servers');
-                ray($response);
 
                 return $response->successful();
             }
@@ -81,6 +84,13 @@ class CloudProviderTokenForm extends Component
                 'name' => $this->name,
             ]);
 
+            auditLog('ui.cloud_token.created', [
+                'team_id' => currentTeam()->id,
+                'cloud_token_uuid' => $savedToken->uuid,
+                'cloud_token_name' => $savedToken->name,
+                'provider' => $savedToken->provider,
+            ]);
+
             $this->reset(['token', 'name']);
 
             // Dispatch event with token ID so parent components can react
diff --git a/app/Livewire/Security/CloudProviderTokens.php b/app/Livewire/Security/CloudProviderTokens.php
index cfef30772..dabb199ed 100644
--- a/app/Livewire/Security/CloudProviderTokens.php
+++ b/app/Livewire/Security/CloudProviderTokens.php
@@ -4,6 +4,7 @@ namespace App\Livewire\Security;
 
 use App\Models\CloudProviderToken;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Http;
 use Livewire\Component;
 
 class CloudProviderTokens extends Component
@@ -14,8 +15,12 @@ class CloudProviderTokens extends Component
 
     public function mount()
     {
-        $this->authorize('viewAny', CloudProviderToken::class);
-        $this->loadTokens();
+        try {
+            $this->authorize('viewAny', CloudProviderToken::class);
+            $this->loadTokens();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function getListeners()
@@ -53,6 +58,14 @@ class CloudProviderTokens extends Component
             } else {
                 $this->dispatch('error', 'Unknown provider.');
             }
+
+            auditLog('ui.cloud_token.validated', [
+                'team_id' => currentTeam()->id,
+                'cloud_token_uuid' => $token->uuid,
+                'cloud_token_name' => $token->name,
+                'provider' => $token->provider,
+                'valid' => $isValid ?? false,
+            ]);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -61,7 +74,7 @@ class CloudProviderTokens extends Component
     private function validateHetznerToken(string $token): bool
     {
         try {
-            $response = \Illuminate\Support\Facades\Http::withToken($token)
+            $response = Http::withToken($token)
                 ->timeout(10)
                 ->get('https://api.hetzner.cloud/v1/servers?per_page=1');
 
@@ -74,7 +87,7 @@ class CloudProviderTokens extends Component
     private function validateDigitalOceanToken(string $token): bool
     {
         try {
-            $response = \Illuminate\Support\Facades\Http::withToken($token)
+            $response = Http::withToken($token)
                 ->timeout(10)
                 ->get('https://api.digitalocean.com/v2/account');
 
@@ -98,9 +111,19 @@ class CloudProviderTokens extends Component
                 return;
             }
 
+            $tokenUuid = $token->uuid;
+            $tokenName = $token->name;
+            $tokenProvider = $token->provider;
             $token->delete();
             $this->loadTokens();
 
+            auditLog('ui.cloud_token.deleted', [
+                'team_id' => currentTeam()->id,
+                'cloud_token_uuid' => $tokenUuid,
+                'cloud_token_name' => $tokenName,
+                'provider' => $tokenProvider,
+            ]);
+
             $this->dispatch('success', 'Cloud provider token deleted successfully.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Security/PrivateKey/Index.php b/app/Livewire/Security/PrivateKey/Index.php
index 1eb66ae3e..0362b65fa 100644
--- a/app/Livewire/Security/PrivateKey/Index.php
+++ b/app/Livewire/Security/PrivateKey/Index.php
@@ -21,8 +21,12 @@ class Index extends Component
 
     public function cleanupUnusedKeys()
     {
-        $this->authorize('create', PrivateKey::class);
-        PrivateKey::cleanupUnusedKeys();
-        $this->dispatch('success', 'Unused keys have been cleaned up.');
+        try {
+            $this->authorize('create', PrivateKey::class);
+            PrivateKey::cleanupUnusedKeys();
+            $this->dispatch('success', 'Unused keys have been cleaned up.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 }
diff --git a/app/Livewire/Server/CloudProviderToken/Show.php b/app/Livewire/Server/CloudProviderToken/Show.php
index 6b22fddc6..e3232d3f3 100644
--- a/app/Livewire/Server/CloudProviderToken/Show.php
+++ b/app/Livewire/Server/CloudProviderToken/Show.php
@@ -5,6 +5,7 @@ namespace App\Livewire\Server\CloudProviderToken;
 use App\Models\CloudProviderToken;
 use App\Models\Server;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Http;
 use Livewire\Component;
 
 class Show extends Component
@@ -67,6 +68,16 @@ class Show extends Component
 
             $this->server->cloudProviderToken()->associate($ownedToken);
             $this->server->save();
+
+            auditLog('ui.server.cloud_token_assigned', [
+                'team_id' => currentTeam()->id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+                'cloud_token_uuid' => $ownedToken->uuid,
+                'cloud_token_name' => $ownedToken->name,
+                'provider' => $ownedToken->provider,
+            ]);
+
             $this->dispatch('success', 'Hetzner token updated successfully.');
             $this->dispatch('refreshServerShow');
         } catch (\Exception $e) {
@@ -79,7 +90,7 @@ class Show extends Component
     {
         try {
             // First, validate the token itself
-            $response = \Illuminate\Support\Facades\Http::withHeaders([
+            $response = Http::withHeaders([
                 'Authorization' => 'Bearer '.$token->token,
             ])->timeout(10)->get('https://api.hetzner.cloud/v1/servers');
 
@@ -92,7 +103,7 @@ class Show extends Component
 
             // Check if this token can access the specific Hetzner server
             if ($this->server->hetzner_server_id) {
-                $serverResponse = \Illuminate\Support\Facades\Http::withHeaders([
+                $serverResponse = Http::withHeaders([
                     'Authorization' => 'Bearer '.$token->token,
                 ])->timeout(10)->get("https://api.hetzner.cloud/v1/servers/{$this->server->hetzner_server_id}");
 
@@ -123,7 +134,7 @@ class Show extends Component
                 return;
             }
 
-            $response = \Illuminate\Support\Facades\Http::withHeaders([
+            $response = Http::withHeaders([
                 'Authorization' => 'Bearer '.$token->token,
             ])->timeout(10)->get('https://api.hetzner.cloud/v1/servers');
 
@@ -132,6 +143,16 @@ class Show extends Component
             } else {
                 $this->dispatch('error', 'Hetzner token is invalid or has insufficient permissions.');
             }
+
+            auditLog('ui.server.cloud_token_validated', [
+                'team_id' => currentTeam()->id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+                'cloud_token_uuid' => $token->uuid,
+                'cloud_token_name' => $token->name,
+                'provider' => $token->provider,
+                'valid' => $response->successful(),
+            ]);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Server/CloudflareTunnel.php b/app/Livewire/Server/CloudflareTunnel.php
index 24f8e022e..2ab829854 100644
--- a/app/Livewire/Server/CloudflareTunnel.php
+++ b/app/Livewire/Server/CloudflareTunnel.php
@@ -72,12 +72,16 @@ class CloudflareTunnel extends Component
 
     public function manualCloudflareConfig()
     {
-        $this->authorize('update', $this->server);
-        $this->isCloudflareTunnelsEnabled = true;
-        $this->server->settings->is_cloudflare_tunnel = true;
-        $this->server->settings->save();
-        $this->server->refresh();
-        $this->dispatch('success', 'Cloudflare Tunnel enabled.');
+        try {
+            $this->authorize('update', $this->server);
+            $this->isCloudflareTunnelsEnabled = true;
+            $this->server->settings->is_cloudflare_tunnel = true;
+            $this->server->settings->save();
+            $this->server->refresh();
+            $this->dispatch('success', 'Cloudflare Tunnel enabled.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function automatedCloudflareConfig()
diff --git a/app/Livewire/Server/Destinations.php b/app/Livewire/Server/Destinations.php
index f3f142646..7b5d6f9da 100644
--- a/app/Livewire/Server/Destinations.php
+++ b/app/Livewire/Server/Destinations.php
@@ -69,6 +69,11 @@ class Destinations extends Component
 
     public function scan()
     {
+        try {
+            $this->authorize('update', $this->server);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
         if ($this->server->isSwarm()) {
             $alreadyAddedNetworks = $this->server->swarmDockers;
         } else {
diff --git a/app/Livewire/Server/New/ByHetzner.php b/app/Livewire/Server/New/ByHetzner.php
index 4c6f31b0c..9ae065d83 100644
--- a/app/Livewire/Server/New/ByHetzner.php
+++ b/app/Livewire/Server/New/ByHetzner.php
@@ -79,14 +79,18 @@ class ByHetzner extends Component
 
     public function mount()
     {
-        $this->authorize('viewAny', CloudProviderToken::class);
-        $this->loadTokens();
-        $this->loadSavedCloudInitScripts();
-        $this->server_name = generate_random_name();
-        $this->private_keys = PrivateKey::ownedAndOnlySShKeys()->where('id', '!=', 0)->get();
+        try {
+            $this->authorize('viewAny', CloudProviderToken::class);
+            $this->loadTokens();
+            $this->loadSavedCloudInitScripts();
+            $this->server_name = generate_random_name();
+            $this->private_keys = PrivateKey::ownedAndOnlySShKeys()->where('id', '!=', 0)->get();
 
-        if ($this->private_keys->count() > 0) {
-            $this->private_key_id = $this->private_keys->first()->id;
+            if ($this->private_keys->count() > 0) {
+                $this->private_key_id = $this->private_keys->first()->id;
+            }
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
diff --git a/app/Livewire/Server/Proxy.php b/app/Livewire/Server/Proxy.php
index c2d8205ef..8cd4e9640 100644
--- a/app/Livewire/Server/Proxy.php
+++ b/app/Livewire/Server/Proxy.php
@@ -102,11 +102,15 @@ class Proxy extends Component
 
     public function changeProxy()
     {
-        $this->authorize('update', $this->server);
-        $this->server->proxy = null;
-        $this->server->save();
+        try {
+            $this->authorize('update', $this->server);
+            $this->server->proxy = null;
+            $this->server->save();
 
-        $this->dispatch('reloadWindow');
+            $this->dispatch('reloadWindow');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function selectProxy($proxy_type)
diff --git a/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php b/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php
index 20d14ddc7..4ea21e4ae 100644
--- a/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php
+++ b/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php
@@ -22,33 +22,37 @@ class DynamicConfigurationNavbar extends Component
 
     public function delete(string $fileName)
     {
-        $this->authorize('update', $this->server);
-        $proxy_path = $this->server->proxyPath();
-        $proxy_type = $this->server->proxyType();
+        try {
+            $this->authorize('update', $this->server);
+            $proxy_path = $this->server->proxyPath();
+            $proxy_type = $this->server->proxyType();
 
-        // Decode filename: pipes are used to encode dots for Livewire property binding
-        // (e.g., 'my|service.yaml' -> 'my.service.yaml')
-        // This must happen BEFORE validation because validateFilenameSafe()
-        // rejects pipe characters through validateShellSafePath().
-        $file = str_replace('|', '.', $fileName);
+            // Decode filename: pipes are used to encode dots for Livewire property binding
+            // (e.g., 'my|service.yaml' -> 'my.service.yaml')
+            // This must happen BEFORE validation because validateFilenameSafe()
+            // rejects pipe characters through validateShellSafePath().
+            $file = str_replace('|', '.', $fileName);
 
-        validateFilenameSafe($file, 'proxy configuration filename');
+            validateFilenameSafe($file, 'proxy configuration filename');
 
-        if ($proxy_type === 'CADDY' && $file === 'Caddyfile') {
-            $this->dispatch('error', 'Cannot delete Caddyfile.');
+            if ($proxy_type === 'CADDY' && $file === 'Caddyfile') {
+                $this->dispatch('error', 'Cannot delete Caddyfile.');
 
-            return;
+                return;
+            }
+
+            $fullPath = "{$proxy_path}/dynamic/{$file}";
+            $escapedPath = escapeshellarg($fullPath);
+            instant_remote_process(["rm -f {$escapedPath}"], $this->server);
+            if ($proxy_type === 'CADDY') {
+                $this->server->reloadCaddy();
+            }
+            $this->dispatch('success', 'File deleted.');
+            $this->dispatch('loadDynamicConfigurations');
+            $this->dispatch('refresh');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-
-        $fullPath = "{$proxy_path}/dynamic/{$file}";
-        $escapedPath = escapeshellarg($fullPath);
-        instant_remote_process(["rm -f {$escapedPath}"], $this->server);
-        if ($proxy_type === 'CADDY') {
-            $this->server->reloadCaddy();
-        }
-        $this->dispatch('success', 'File deleted.');
-        $this->dispatch('loadDynamicConfigurations');
-        $this->dispatch('refresh');
     }
 
     public function render()
diff --git a/app/Livewire/Server/Proxy/DynamicConfigurations.php b/app/Livewire/Server/Proxy/DynamicConfigurations.php
index 6ea9e7c3d..f824645aa 100644
--- a/app/Livewire/Server/Proxy/DynamicConfigurations.php
+++ b/app/Livewire/Server/Proxy/DynamicConfigurations.php
@@ -3,11 +3,14 @@
 namespace App\Livewire\Server\Proxy;
 
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
 
 class DynamicConfigurations extends Component
 {
+    use AuthorizesRequests;
+
     public ?Server $server = null;
 
     public $parameters = [];
@@ -35,6 +38,11 @@ class DynamicConfigurations extends Component
 
     public function loadDynamicConfigurations()
     {
+        try {
+            $this->authorize('view', $this->server);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
         $proxy_path = $this->server->proxyPath();
         $files = instant_remote_process(["mkdir -p $proxy_path/dynamic && ls -1 {$proxy_path}/dynamic"], $this->server);
         $files = collect(explode("\n", $files))->filter(fn ($file) => ! empty($file));
diff --git a/app/Livewire/Server/Resources.php b/app/Livewire/Server/Resources.php
index 3710064dc..9ea87161d 100644
--- a/app/Livewire/Server/Resources.php
+++ b/app/Livewire/Server/Resources.php
@@ -30,38 +30,53 @@ class Resources extends Component
 
     public function startUnmanaged($id)
     {
-        if (! ValidationPatterns::isValidContainerName($id)) {
-            $this->dispatch('error', 'Invalid container identifier.');
+        try {
+            $this->authorize('update', $this->server);
+            if (! ValidationPatterns::isValidContainerName($id)) {
+                $this->dispatch('error', 'Invalid container identifier.');
 
-            return;
+                return;
+            }
+            $this->server->startUnmanaged($id);
+            $this->dispatch('success', 'Container started.');
+            $this->loadUnmanagedContainers();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $this->server->startUnmanaged($id);
-        $this->dispatch('success', 'Container started.');
-        $this->loadUnmanagedContainers();
     }
 
     public function restartUnmanaged($id)
     {
-        if (! ValidationPatterns::isValidContainerName($id)) {
-            $this->dispatch('error', 'Invalid container identifier.');
+        try {
+            $this->authorize('update', $this->server);
+            if (! ValidationPatterns::isValidContainerName($id)) {
+                $this->dispatch('error', 'Invalid container identifier.');
 
-            return;
+                return;
+            }
+            $this->server->restartUnmanaged($id);
+            $this->dispatch('success', 'Container restarted.');
+            $this->loadUnmanagedContainers();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $this->server->restartUnmanaged($id);
-        $this->dispatch('success', 'Container restarted.');
-        $this->loadUnmanagedContainers();
     }
 
     public function stopUnmanaged($id)
     {
-        if (! ValidationPatterns::isValidContainerName($id)) {
-            $this->dispatch('error', 'Invalid container identifier.');
+        try {
+            $this->authorize('update', $this->server);
+            if (! ValidationPatterns::isValidContainerName($id)) {
+                $this->dispatch('error', 'Invalid container identifier.');
 
-            return;
+                return;
+            }
+            $this->server->stopUnmanaged($id);
+            $this->dispatch('success', 'Container stopped.');
+            $this->loadUnmanagedContainers();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $this->server->stopUnmanaged($id);
-        $this->dispatch('success', 'Container stopped.');
-        $this->loadUnmanagedContainers();
     }
 
     public function refreshStatus()
diff --git a/app/Livewire/Server/Security/Patches.php b/app/Livewire/Server/Security/Patches.php
index b4d151424..087836da3 100644
--- a/app/Livewire/Server/Security/Patches.php
+++ b/app/Livewire/Server/Security/Patches.php
@@ -41,7 +41,11 @@ class Patches extends Component
     {
         $this->parameters = get_route_parameters();
         $this->server = Server::ownedByCurrentTeam()->whereUuid($this->parameters['server_uuid'])->firstOrFail();
-        $this->authorize('viewSecurity', $this->server);
+        try {
+            $this->authorize('viewSecurity', $this->server);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function checkForUpdatesDispatch()
@@ -69,14 +73,14 @@ class Patches extends Component
 
     public function updateAllPackages()
     {
-        $this->authorize('update', $this->server);
-        if (! $this->packageManager || ! $this->osId) {
-            $this->dispatch('error', message: 'Run "Check for updates" first.');
-
-            return;
-        }
-
         try {
+            $this->authorize('update', $this->server);
+            if (! $this->packageManager || ! $this->osId) {
+                $this->dispatch('error', message: 'Run "Check for updates" first.');
+
+                return;
+            }
+
             $activity = UpdatePackage::run(
                 server: $this->server,
                 packageManager: $this->packageManager,
@@ -84,8 +88,8 @@ class Patches extends Component
                 all: true
             );
             $this->dispatch('activityMonitor', $activity->id, ServerPackageUpdated::class);
-        } catch (\Exception $e) {
-            $this->dispatch('error', message: $e->getMessage());
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
diff --git a/app/Livewire/Server/Sentinel/Logs.php b/app/Livewire/Server/Sentinel/Logs.php
index 6619e101e..1190cd59a 100644
--- a/app/Livewire/Server/Sentinel/Logs.php
+++ b/app/Livewire/Server/Sentinel/Logs.php
@@ -3,11 +3,14 @@
 namespace App\Livewire\Server\Sentinel;
 
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\View\View;
 use Livewire\Component;
 
 class Logs extends Component
 {
+    use AuthorizesRequests;
+
     public ?Server $server = null;
 
     public array $parameters = [];
@@ -19,7 +22,11 @@ class Logs extends Component
             $this->server = Server::ownedByCurrentTeam()->whereUuid(request()->server_uuid)->firstOrFail();
         } catch (\Throwable $e) {
             handleError($e, $this);
+
+            return;
         }
+
+        $this->authorize('viewSentinel', $this->server);
     }
 
     public function render(): View
diff --git a/app/Livewire/Server/Sentinel/Show.php b/app/Livewire/Server/Sentinel/Show.php
index 7070a09ce..fc30994d6 100644
--- a/app/Livewire/Server/Sentinel/Show.php
+++ b/app/Livewire/Server/Sentinel/Show.php
@@ -3,11 +3,14 @@
 namespace App\Livewire\Server\Sentinel;
 
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\View\View;
 use Livewire\Component;
 
 class Show extends Component
 {
+    use AuthorizesRequests;
+
     public ?Server $server = null;
 
     public array $parameters = [];
@@ -19,7 +22,11 @@ class Show extends Component
             $this->server = Server::ownedByCurrentTeam()->whereUuid(request()->server_uuid)->firstOrFail();
         } catch (\Throwable $e) {
             handleError($e, $this);
+
+            return;
         }
+
+        $this->authorize('viewSentinel', $this->server);
     }
 
     public function render(): View
diff --git a/app/Livewire/Server/Show.php b/app/Livewire/Server/Show.php
index 4a6e2335e..d14046ed1 100644
--- a/app/Livewire/Server/Show.php
+++ b/app/Livewire/Server/Show.php
@@ -299,18 +299,22 @@ class Show extends Component
 
     public function checkLocalhostConnection()
     {
-        $this->syncData(true);
-        ['uptime' => $uptime, 'error' => $error] = $this->server->validateConnection();
-        if ($uptime) {
-            $this->dispatch('success', 'Server is reachable.');
-            $this->server->settings->is_reachable = $this->isReachable = true;
-            $this->server->settings->is_usable = $this->isUsable = true;
-            $this->server->settings->save();
-            ServerReachabilityChanged::dispatch($this->server);
-        } else {
-            $this->dispatch('error', 'Server is not reachable.', 'Please validate your configuration and connection.<br><br>Check this <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/openssh">documentation</a> for further help. <br><br>Error: '.$error);
+        try {
+            $this->syncData(true);
+            ['uptime' => $uptime, 'error' => $error] = $this->server->validateConnection();
+            if ($uptime) {
+                $this->dispatch('success', 'Server is reachable.');
+                $this->server->settings->is_reachable = $this->isReachable = true;
+                $this->server->settings->is_usable = $this->isUsable = true;
+                $this->server->settings->save();
+                ServerReachabilityChanged::dispatch($this->server);
+            } else {
+                $this->dispatch('error', 'Server is not reachable.', 'Please validate your configuration and connection.<br><br>Check this <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/openssh">documentation</a> for further help. <br><br>Error: '.$error);
 
-            return;
+                return;
+            }
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
@@ -413,6 +417,7 @@ class Show extends Component
     public function checkHetznerServerStatus(bool $manual = false)
     {
         try {
+            $this->authorize('view', $this->server);
             if (! $this->server->hetzner_server_id || ! $this->server->cloudProviderToken) {
                 $this->dispatch('error', 'This server is not associated with a Hetzner Cloud server or token.');
 
@@ -480,6 +485,7 @@ class Show extends Component
     public function startHetznerServer()
     {
         try {
+            $this->authorize('update', $this->server);
             if (! $this->server->hetzner_server_id || ! $this->server->cloudProviderToken) {
                 $this->dispatch('error', 'This server is not associated with a Hetzner Cloud server or token.');
 
diff --git a/app/Livewire/Server/ValidateAndInstall.php b/app/Livewire/Server/ValidateAndInstall.php
index 59ca4cd36..afcc918a6 100644
--- a/app/Livewire/Server/ValidateAndInstall.php
+++ b/app/Livewire/Server/ValidateAndInstall.php
@@ -72,32 +72,40 @@ class ValidateAndInstall extends Component
 
     public function retry()
     {
-        $this->authorize('update', $this->server);
-        $this->uptime = null;
-        $this->supported_os_type = null;
-        $this->prerequisites_installed = null;
-        $this->docker_installed = null;
-        $this->docker_compose_installed = null;
-        $this->docker_version = null;
-        $this->error = null;
-        $this->number_of_tries = 0;
-        $this->init();
+        try {
+            $this->authorize('update', $this->server);
+            $this->uptime = null;
+            $this->supported_os_type = null;
+            $this->prerequisites_installed = null;
+            $this->docker_installed = null;
+            $this->docker_compose_installed = null;
+            $this->docker_version = null;
+            $this->error = null;
+            $this->number_of_tries = 0;
+            $this->init();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function validateConnection()
     {
-        $this->authorize('update', $this->server);
-        ['uptime' => $this->uptime, 'error' => $error] = $this->server->validateConnection();
-        if (! $this->uptime) {
-            $sanitizedError = htmlspecialchars($error ?? '', ENT_QUOTES, 'UTF-8');
-            $this->error = 'Server is not reachable. Please validate your configuration and connection.<br>Check this <a target="_blank" class="text-black underline dark:text-white" href="https://coolify.io/docs/knowledge-base/server/openssh">documentation</a> for further help. <br><br><div class="text-error">Error: '.$sanitizedError.'</div>';
-            $this->server->update([
-                'validation_logs' => $this->error,
-            ]);
+        try {
+            $this->authorize('update', $this->server);
+            ['uptime' => $this->uptime, 'error' => $error] = $this->server->validateConnection();
+            if (! $this->uptime) {
+                $sanitizedError = htmlspecialchars($error ?? '', ENT_QUOTES, 'UTF-8');
+                $this->error = 'Server is not reachable. Please validate your configuration and connection.<br>Check this <a target="_blank" class="text-black underline dark:text-white" href="https://coolify.io/docs/knowledge-base/server/openssh">documentation</a> for further help. <br><br><div class="text-error">Error: '.$sanitizedError.'</div>';
+                $this->server->update([
+                    'validation_logs' => $this->error,
+                ]);
 
-            return;
+                return;
+            }
+            $this->dispatch('validateOS');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $this->dispatch('validateOS');
     }
 
     public function validateOS()
diff --git a/app/Livewire/Settings/Advanced.php b/app/Livewire/Settings/Advanced.php
index 3a6237183..5be066c7f 100644
--- a/app/Livewire/Settings/Advanced.php
+++ b/app/Livewire/Settings/Advanced.php
@@ -5,11 +5,14 @@ namespace App\Livewire\Settings;
 use App\Models\InstanceSettings;
 use App\Rules\ValidDnsServers;
 use App\Rules\ValidIpOrCidr;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class Advanced extends Component
 {
+    use AuthorizesRequests;
+
     public InstanceSettings $settings;
 
     #[Validate('boolean')]
@@ -77,6 +80,7 @@ class Advanced extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->validate();
 
             $this->custom_dns_servers = str($this->custom_dns_servers)->replaceEnd(',', '')->trim();
@@ -146,6 +150,7 @@ class Advanced extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->settings->is_registration_enabled = $this->is_registration_enabled;
             $this->settings->do_not_track = $this->do_not_track;
             $this->settings->is_dns_validation_enabled = $this->is_dns_validation_enabled;
@@ -178,6 +183,7 @@ class Advanced extends Component
 
     public function toggleTwoStepConfirmation($password): bool
     {
+        $this->authorize('update', $this->settings);
         if (! verifyPasswordConfirmation($password, $this)) {
             return false;
         }
diff --git a/app/Livewire/Settings/Index.php b/app/Livewire/Settings/Index.php
index c2789aa91..9cfc4f6c8 100644
--- a/app/Livewire/Settings/Index.php
+++ b/app/Livewire/Settings/Index.php
@@ -4,12 +4,15 @@ namespace App\Livewire\Settings;
 
 use App\Models\InstanceSettings;
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Computed;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class Index extends Component
 {
+    use AuthorizesRequests;
+
     public InstanceSettings $settings;
 
     public ?Server $server = null;
@@ -87,6 +90,7 @@ class Index extends Component
 
     public function instantSave($isSave = true)
     {
+        $this->authorize('update', $this->settings);
         $this->validate();
         $this->settings->fqdn = $this->fqdn ? trim($this->fqdn) : $this->fqdn;
         $this->settings->public_port_min = $this->public_port_min;
@@ -104,6 +108,7 @@ class Index extends Component
 
     public function confirmDomainUsage()
     {
+        $this->authorize('update', $this->settings);
         $this->forceSaveDomains = true;
         $this->showDomainConflictModal = false;
         $this->submit();
@@ -112,6 +117,7 @@ class Index extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->settings);
             $error_show = false;
             $this->resetErrorBag();
 
@@ -173,6 +179,7 @@ class Index extends Component
     public function buildHelperImage()
     {
         try {
+            $this->authorize('update', $this->settings);
             if (! isDev()) {
                 $this->dispatch('error', 'Building helper image is only available in development mode.');
 
diff --git a/app/Livewire/Settings/Updates.php b/app/Livewire/Settings/Updates.php
index a200ef689..88a8945d0 100644
--- a/app/Livewire/Settings/Updates.php
+++ b/app/Livewire/Settings/Updates.php
@@ -5,11 +5,14 @@ namespace App\Livewire\Settings;
 use App\Jobs\CheckForUpdatesJob;
 use App\Models\InstanceSettings;
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class Updates extends Component
 {
+    use AuthorizesRequests;
+
     public InstanceSettings $settings;
 
     public ?Server $server = null;
@@ -41,6 +44,7 @@ class Updates extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             if ($this->settings->is_auto_update_enabled === true) {
                 $this->validate([
                     'auto_update_frequency' => ['required', 'string'],
@@ -59,6 +63,7 @@ class Updates extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->resetErrorBag();
             $this->validate();
 
@@ -91,6 +96,7 @@ class Updates extends Component
 
     public function checkManually()
     {
+        $this->authorize('update', $this->settings);
         CheckForUpdatesJob::dispatchSync();
         $this->dispatch('updateAvailable');
         $settings = instanceSettings();
diff --git a/app/Livewire/SettingsBackup.php b/app/Livewire/SettingsBackup.php
index 5336c0c9a..d5d80acbd 100644
--- a/app/Livewire/SettingsBackup.php
+++ b/app/Livewire/SettingsBackup.php
@@ -8,12 +8,15 @@ use App\Models\ScheduledDatabaseBackup;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\StandalonePostgresql;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class SettingsBackup extends Component
 {
+    use AuthorizesRequests;
+
     public InstanceSettings $settings;
 
     public Server $server;
@@ -77,6 +80,7 @@ class SettingsBackup extends Component
     public function addCoolifyDatabase()
     {
         try {
+            $this->authorize('update', $this->settings);
             $server = Server::findOrFail(0);
             $out = instant_remote_process(['docker inspect coolify-db'], $server);
             $envs = format_docker_envs_to_json($out);
@@ -123,14 +127,19 @@ class SettingsBackup extends Component
 
     public function submit()
     {
-        $this->validate();
+        try {
+            $this->authorize('update', $this->settings);
+            $this->validate();
 
-        $this->database->update([
-            'name' => $this->name,
-            'description' => $this->description,
-            'postgres_user' => $this->postgres_user,
-            'postgres_password' => $this->postgres_password,
-        ]);
-        $this->dispatch('success', 'Backup updated.');
+            $this->database->update([
+                'name' => $this->name,
+                'description' => $this->description,
+                'postgres_user' => $this->postgres_user,
+                'postgres_password' => $this->postgres_password,
+            ]);
+            $this->dispatch('success', 'Backup updated.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 }
diff --git a/app/Livewire/SettingsEmail.php b/app/Livewire/SettingsEmail.php
index 8c0e24400..1bb9b2360 100644
--- a/app/Livewire/SettingsEmail.php
+++ b/app/Livewire/SettingsEmail.php
@@ -5,6 +5,7 @@ namespace App\Livewire;
 use App\Models\InstanceSettings;
 use App\Models\Team;
 use App\Notifications\TransactionalEmails\Test;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\RateLimiter;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
@@ -12,6 +13,8 @@ use Livewire\Component;
 
 class SettingsEmail extends Component
 {
+    use AuthorizesRequests;
+
     public InstanceSettings $settings;
 
     #[Locked]
@@ -103,6 +106,7 @@ class SettingsEmail extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->resetErrorBag();
             $this->syncData(true);
             $this->dispatch('success', 'Transactional email settings updated.');
@@ -114,6 +118,7 @@ class SettingsEmail extends Component
     public function instantSave(string $type)
     {
         try {
+            $this->authorize('update', $this->settings);
             $currentSmtpEnabled = $this->settings->smtp_enabled;
             $currentResendEnabled = $this->settings->resend_enabled;
             $this->resetErrorBag();
@@ -141,6 +146,7 @@ class SettingsEmail extends Component
     public function submitSmtp()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->validate([
                 'smtpEnabled' => 'boolean',
                 'smtpFromAddress' => 'required|email',
@@ -184,6 +190,7 @@ class SettingsEmail extends Component
     public function submitResend()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->validate([
                 'resendEnabled' => 'boolean',
                 'resendApiKey' => 'required|string',
@@ -214,6 +221,7 @@ class SettingsEmail extends Component
     public function sendTestEmail()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->validate([
                 'testEmailAddress' => 'required|email',
             ], [
diff --git a/app/Livewire/SettingsOauth.php b/app/Livewire/SettingsOauth.php
index 6f949b716..44ea4f611 100644
--- a/app/Livewire/SettingsOauth.php
+++ b/app/Livewire/SettingsOauth.php
@@ -3,10 +3,13 @@
 namespace App\Livewire;
 
 use App\Models\OauthSetting;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class SettingsOauth extends Component
 {
+    use AuthorizesRequests;
+
     public $oauth_settings_map;
 
     protected function rules()
@@ -131,6 +134,7 @@ class SettingsOauth extends Component
     public function instantSave(string $provider)
     {
         try {
+            $this->authorize('update', instanceSettings());
             $this->updateOauthSettings($provider);
         } catch (\Exception $e) {
             return handleError($e, $this);
@@ -139,7 +143,12 @@ class SettingsOauth extends Component
 
     public function submit()
     {
-        $this->updateOauthSettings();
-        $this->dispatch('success', 'Instance settings updated successfully!');
+        try {
+            $this->authorize('update', instanceSettings());
+            $this->updateOauthSettings();
+            $this->dispatch('success', 'Instance settings updated successfully!');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 }
diff --git a/app/Livewire/SharedVariables/Environment/Show.php b/app/Livewire/SharedVariables/Environment/Show.php
index bfbdf9212..4bc467959 100644
--- a/app/Livewire/SharedVariables/Environment/Show.php
+++ b/app/Livewire/SharedVariables/Environment/Show.php
@@ -76,7 +76,12 @@ class Show extends Component
 
     private function formatEnvironmentVariables($variables)
     {
-        return $variables->map(function ($item) {
+        $isMember = auth()->user()?->isMember();
+
+        return $variables->map(function ($item) use ($isMember) {
+            if ($isMember) {
+                return "$item->key=(Hidden, only admins can view)";
+            }
             if ($item->is_shown_once) {
                 return "$item->key=(Locked Secret, delete and add again to change)";
             }
diff --git a/app/Livewire/SharedVariables/Project/Show.php b/app/Livewire/SharedVariables/Project/Show.php
index c9f0dcd8e..6b7f26c26 100644
--- a/app/Livewire/SharedVariables/Project/Show.php
+++ b/app/Livewire/SharedVariables/Project/Show.php
@@ -58,9 +58,13 @@ class Show extends Component
 
     public function switch()
     {
-        $this->authorize('view', $this->project);
-        $this->view = $this->view === 'normal' ? 'dev' : 'normal';
-        $this->getDevView();
+        try {
+            $this->authorize('view', $this->project);
+            $this->view = $this->view === 'normal' ? 'dev' : 'normal';
+            $this->getDevView();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function getDevView()
@@ -70,7 +74,12 @@ class Show extends Component
 
     private function formatEnvironmentVariables($variables)
     {
-        return $variables->map(function ($item) {
+        $isMember = auth()->user()?->isMember();
+
+        return $variables->map(function ($item) use ($isMember) {
+            if ($isMember) {
+                return "$item->key=(Hidden, only admins can view)";
+            }
             if ($item->is_shown_once) {
                 return "$item->key=(Locked Secret, delete and add again to change)";
             }
diff --git a/app/Livewire/SharedVariables/Team/Index.php b/app/Livewire/SharedVariables/Team/Index.php
index 29e21a1b7..32da83672 100644
--- a/app/Livewire/SharedVariables/Team/Index.php
+++ b/app/Livewire/SharedVariables/Team/Index.php
@@ -52,9 +52,13 @@ class Index extends Component
 
     public function switch()
     {
-        $this->authorize('view', $this->team);
-        $this->view = $this->view === 'normal' ? 'dev' : 'normal';
-        $this->getDevView();
+        try {
+            $this->authorize('view', $this->team);
+            $this->view = $this->view === 'normal' ? 'dev' : 'normal';
+            $this->getDevView();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function getDevView()
@@ -64,7 +68,12 @@ class Index extends Component
 
     private function formatEnvironmentVariables($variables)
     {
-        return $variables->map(function ($item) {
+        $isMember = auth()->user()?->isMember();
+
+        return $variables->map(function ($item) use ($isMember) {
+            if ($isMember) {
+                return "$item->key=(Hidden, only admins can view)";
+            }
             if ($item->is_shown_once) {
                 return "$item->key=(Locked Secret, delete and add again to change)";
             }
diff --git a/app/Livewire/Storage/Form.php b/app/Livewire/Storage/Form.php
index 342d629cb..b83b41e9f 100644
--- a/app/Livewire/Storage/Form.php
+++ b/app/Livewire/Storage/Form.php
@@ -33,6 +33,8 @@ class Form extends Component
 
     public ?bool $isUsable = null;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected function rules(): array
     {
         return [
@@ -110,6 +112,12 @@ class Form extends Component
     public function mount()
     {
         $this->syncData(false);
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->key = '';
+            $this->secret = '';
+        }
     }
 
     public function testConnection()
diff --git a/app/Livewire/Storage/Resources.php b/app/Livewire/Storage/Resources.php
index 0dad2d548..4f39943e4 100644
--- a/app/Livewire/Storage/Resources.php
+++ b/app/Livewire/Storage/Resources.php
@@ -4,16 +4,21 @@ namespace App\Livewire\Storage;
 
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Resources extends Component
 {
+    use AuthorizesRequests;
+
     public S3Storage $storage;
 
     public array $selectedStorages = [];
 
     public function mount(): void
     {
+        $this->authorize('view', $this->storage);
+
         $backups = ScheduledDatabaseBackup::where('s3_storage_id', $this->storage->id)
             ->where('save_s3', true)
             ->get();
@@ -25,6 +30,8 @@ class Resources extends Component
 
     public function disableS3(int $backupId): void
     {
+        $this->authorize('update', $this->storage);
+
         $backup = ScheduledDatabaseBackup::where('id', $backupId)
             ->where('s3_storage_id', $this->storage->id)
             ->firstOrFail();
@@ -41,6 +48,8 @@ class Resources extends Component
 
     public function moveBackup(int $backupId): void
     {
+        $this->authorize('update', $this->storage);
+
         $backup = ScheduledDatabaseBackup::where('id', $backupId)
             ->where('s3_storage_id', $this->storage->id)
             ->firstOrFail();
@@ -62,6 +71,8 @@ class Resources extends Component
             return;
         }
 
+        $this->authorize('update', $newStorage);
+
         $backup->update(['s3_storage_id' => $newStorage->id]);
 
         unset($this->selectedStorages[$backupId]);
diff --git a/app/Livewire/Storage/Show.php b/app/Livewire/Storage/Show.php
index dc5121e94..dd6640c23 100644
--- a/app/Livewire/Storage/Show.php
+++ b/app/Livewire/Storage/Show.php
@@ -4,6 +4,7 @@ namespace App\Livewire\Storage;
 
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -23,7 +24,11 @@ class Show extends Component
         if (! $this->storage) {
             abort(404);
         }
-        $this->authorize('view', $this->storage);
+        try {
+            $this->authorize('view', $this->storage);
+        } catch (AuthorizationException) {
+            return $this->redirectRoute('storage.index', navigate: true);
+        }
         $this->currentRoute = request()->route()->getName();
         $this->backupCount = ScheduledDatabaseBackup::where('s3_storage_id', $this->storage->id)->count();
     }
diff --git a/app/Livewire/Tags/Show.php b/app/Livewire/Tags/Show.php
index fc5b13374..28d6440a9 100644
--- a/app/Livewire/Tags/Show.php
+++ b/app/Livewire/Tags/Show.php
@@ -5,6 +5,7 @@ namespace App\Livewire\Tags;
 use App\Http\Controllers\Api\DeployController;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Tag;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Title;
@@ -13,6 +14,8 @@ use Livewire\Component;
 #[Title('Tags | Coolify')]
 class Show extends Component
 {
+    use AuthorizesRequests;
+
     #[Locked]
     public ?string $tagName = null;
 
@@ -73,6 +76,12 @@ class Show extends Component
     public function redeployAll()
     {
         try {
+            $this->applications->each(function ($resource) {
+                $this->authorize('deploy', $resource);
+            });
+            $this->services->each(function ($resource) {
+                $this->authorize('deploy', $resource);
+            });
             $message = collect([]);
             $this->applications->each(function ($resource) use ($message) {
                 $deploy = new DeployController;
diff --git a/app/Livewire/Team/AdminView.php b/app/Livewire/Team/AdminView.php
index 09878f27b..b9cb3a43b 100644
--- a/app/Livewire/Team/AdminView.php
+++ b/app/Livewire/Team/AdminView.php
@@ -25,6 +25,9 @@ class AdminView extends Component
 
     public function submitSearch()
     {
+        if (! isInstanceAdmin()) {
+            return;
+        }
         if ($this->search !== '') {
             $this->users = User::where(function ($query) {
                 $query->where('name', 'like', "%{$this->search}%")
@@ -39,6 +42,9 @@ class AdminView extends Component
 
     public function getUsers()
     {
+        if (! isInstanceAdmin()) {
+            return;
+        }
         $users = User::where('id', '!=', auth()->id())->get();
         if ($users->count() > $this->number_of_users_to_show) {
             $this->lots_of_users = true;
diff --git a/app/Livewire/Team/Index.php b/app/Livewire/Team/Index.php
index 8a943e6b6..140d9f5cc 100644
--- a/app/Livewire/Team/Index.php
+++ b/app/Livewire/Team/Index.php
@@ -7,6 +7,7 @@ use App\Models\TeamInvitation;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
 use Livewire\Component;
 
@@ -95,23 +96,31 @@ class Index extends Component
 
     public function delete()
     {
-        $currentTeam = currentTeam();
-        $this->authorize('delete', $currentTeam);
-        $currentTeam->delete();
+        try {
+            $currentTeam = currentTeam();
+            $this->authorize('delete', $currentTeam);
+            $currentTeam->members->each(function ($user) use ($currentTeam) {
+                if ($user->id === Auth::id()) {
+                    return;
+                }
+                $user->teams()->detach($currentTeam);
+                $session = DB::table('sessions')->where('user_id', $user->id)->first();
+                if ($session) {
+                    DB::table('sessions')->where('id', $session->id)->delete();
+                }
+            });
 
-        $currentTeam->members->each(function ($user) use ($currentTeam) {
-            if ($user->id === Auth::id()) {
-                return;
-            }
-            $user->teams()->detach($currentTeam);
-            $session = DB::table('sessions')->where('user_id', $user->id)->first();
-            if ($session) {
-                DB::table('sessions')->where('id', $session->id)->delete();
-            }
-        });
+            // Clear stale cache before deleting so refreshSession doesn't resolve the deleted team
+            Cache::forget('user:'.Auth::id().':team:'.$currentTeam->id);
+            $currentTeam->delete();
 
-        refreshSession();
+            // Switch to the user's next available team
+            $newTeam = Auth::user()->teams()->first();
+            refreshSession($newTeam);
 
-        return redirect()->route('team.index');
+            return redirect()->route('team.index');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 }
diff --git a/app/Livewire/Team/InviteLink.php b/app/Livewire/Team/InviteLink.php
index fb30961e9..5b040db71 100644
--- a/app/Livewire/Team/InviteLink.php
+++ b/app/Livewire/Team/InviteLink.php
@@ -10,7 +10,6 @@ use Illuminate\Support\Facades\Crypt;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Str;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class InviteLink extends Component
 {
@@ -61,7 +60,7 @@ class InviteLink extends Component
             if ($member_emails->contains($this->email)) {
                 return handleError(livewire: $this, customErrorMessage: "$this->email is already a member of ".currentTeam()->name.'.');
             }
-            $uuid = (string) new Cuid2(32);
+            $uuid = new_public_id(32);
             $link = url('/').config('constants.invitation.link.base_url').$uuid;
             $user = User::whereEmail($this->email)->first();
 
diff --git a/app/Livewire/Upgrade.php b/app/Livewire/Upgrade.php
index 1b8701d94..0ccb06a08 100644
--- a/app/Livewire/Upgrade.php
+++ b/app/Livewire/Upgrade.php
@@ -62,6 +62,9 @@ class Upgrade extends Component
     public function upgrade()
     {
         try {
+            if (! isInstanceAdmin()) {
+                abort(403);
+            }
             if ($this->updateInProgress) {
                 return;
             }
diff --git a/app/Mcp/Concerns/ResolvesTeam.php b/app/Mcp/Concerns/ResolvesTeam.php
index f6d82453a..8e0ae0467 100644
--- a/app/Mcp/Concerns/ResolvesTeam.php
+++ b/app/Mcp/Concerns/ResolvesTeam.php
@@ -7,15 +7,19 @@ use Laravel\Mcp\Response;
 
 trait ResolvesTeam
 {
-    protected function ensureAbility(Request $request, string $ability = 'read'): ?Response
+    protected function ensureAbility(Request $request, string $ability = 'read', ?string $tool = null): ?Response
     {
         $user = $request->user();
         if (! $user) {
+            $this->auditMcpTool($request, $tool, 'denied', ['reason' => 'unauthenticated']);
+
             return Response::error('Unauthenticated.');
         }
 
         $token = $user->currentAccessToken();
         if (! $token) {
+            $this->auditMcpTool($request, $tool, 'denied', ['reason' => 'invalid_token']);
+
             return Response::error('Invalid token.');
         }
 
@@ -23,6 +27,11 @@ trait ResolvesTeam
             return null;
         }
 
+        $this->auditMcpTool($request, $tool, 'denied', [
+            'reason' => 'missing_ability',
+            'required_ability' => $ability,
+        ]);
+
         return Response::error("Missing required permissions: {$ability}");
     }
 
@@ -38,4 +47,28 @@ trait ResolvesTeam
 
         return (int) $teamId;
     }
+
+    protected function mcpSuccess(Request $request, Response $response, array $context = []): Response
+    {
+        $this->auditMcpTool($request, $this->name ?? null, 'success', $context);
+
+        return $response;
+    }
+
+    protected function mcpError(Request $request, string $message, array $context = []): Response
+    {
+        $this->auditMcpTool($request, $this->name ?? null, 'error', $context + ['reason' => $message]);
+
+        return Response::error($message);
+    }
+
+    protected function auditMcpTool(Request $request, ?string $tool, string $outcome, array $context = []): void
+    {
+        auditLog('mcp.tool.called', [
+            'tool' => $tool ?: 'unknown',
+            'team_id' => $this->resolveTeamId($request),
+            'outcome' => $outcome,
+            ...$context,
+        ]);
+    }
 }
diff --git a/app/Mcp/Servers/CoolifyServer.php b/app/Mcp/Servers/CoolifyServer.php
index aff7e3f76..2b2d33d60 100644
--- a/app/Mcp/Servers/CoolifyServer.php
+++ b/app/Mcp/Servers/CoolifyServer.php
@@ -13,13 +13,14 @@ use App\Mcp\Tools\ListProjects;
 use App\Mcp\Tools\ListServers;
 use App\Mcp\Tools\ListServices;
 use Laravel\Mcp\Server;
-use Laravel\Mcp\Server\Attributes\Instructions;
-use Laravel\Mcp\Server\Attributes\Name;
-use Laravel\Mcp\Server\Attributes\Version;
 
-#[Name('Coolify')]
-#[Version('0.1.0')]
-#[Instructions(<<<'MD'
+class CoolifyServer extends Server
+{
+    protected string $name = 'Coolify';
+
+    protected string $version = '0.1.0';
+
+    protected string $instructions = <<<'MD'
 Read-only MCP server for Coolify, scoped to the authenticated team token.
 
 Recommended workflow:
@@ -28,9 +29,8 @@ Recommended workflow:
 3. get_server / get_application / get_database / get_service — full details for a single UUID.
 
 Every response is `{ data, _actions?, _pagination? }`. `_actions` suggests the next tool + args; `_pagination.next` is the args to call again for the next page.
-MD)]
-class CoolifyServer extends Server
-{
+MD;
+
     protected array $tools = [
         GetInfrastructureOverview::class,
         ListServers::class,
diff --git a/app/Mcp/Tools/GetApplication.php b/app/Mcp/Tools/GetApplication.php
index f7ac8db77..1d2f9f014 100644
--- a/app/Mcp/Tools/GetApplication.php
+++ b/app/Mcp/Tools/GetApplication.php
@@ -8,36 +8,36 @@ use App\Models\Application;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('get_application')]
-#[Description('Get full details for a single application by UUID.')]
 class GetApplication extends Tool
 {
+    protected string $name = 'get_application';
+
+    protected string $description = 'Get full details for a single application by UUID.';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $uuid = $request->get('uuid');
         if (! is_string($uuid) || $uuid === '') {
-            return Response::error('uuid argument is required.');
+            return $this->mcpError($request, 'uuid argument is required.');
         }
 
         $application = Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $uuid)->first();
         if (! $application) {
-            return Response::error("Application [{$uuid}] not found.");
+            return $this->mcpError($request, "Application [{$uuid}] not found.", ['resource_uuid' => $uuid]);
         }
 
         // Drop relations that the server_status accessor lazy-loads — they
@@ -45,10 +45,10 @@ class GetApplication extends Tool
         $application->setRelations([]);
         $application->makeHidden(['destination', 'source', 'additional_servers', 'environment', 'tags', 'environmentVariables']);
 
-        return $this->respond(
+        return $this->mcpSuccess($request, $this->respond(
             $this->scrubSensitive($application->toArray()),
             $this->actionsForApplication($uuid, $application->status),
-        );
+        ), ['resource_uuid' => $uuid]);
     }
 
     public function schema(JsonSchema $schema): array
diff --git a/app/Mcp/Tools/GetDatabase.php b/app/Mcp/Tools/GetDatabase.php
index 4eee9c961..c5d62e3a0 100644
--- a/app/Mcp/Tools/GetDatabase.php
+++ b/app/Mcp/Tools/GetDatabase.php
@@ -7,46 +7,46 @@ use App\Mcp\Concerns\ResolvesTeam;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('get_database')]
-#[Description('Get full details for a standalone database by UUID. Detects type across postgresql, mysql, mariadb, mongodb, redis, keydb, dragonfly, clickhouse.')]
 class GetDatabase extends Tool
 {
+    protected string $name = 'get_database';
+
+    protected string $description = 'Get full details for a standalone database by UUID. Detects type across postgresql, mysql, mariadb, mongodb, redis, keydb, dragonfly, clickhouse.';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $uuid = $request->get('uuid');
         if (! is_string($uuid) || $uuid === '') {
-            return Response::error('uuid argument is required.');
+            return $this->mcpError($request, 'uuid argument is required.');
         }
 
         $database = queryDatabaseByUuidWithinTeam($uuid, (string) $teamId);
         if (! $database) {
-            return Response::error("Database [{$uuid}] not found.");
+            return $this->mcpError($request, "Database [{$uuid}] not found.", ['resource_uuid' => $uuid]);
         }
 
         // Drop relations so deep server/destination data doesn't leak.
         $database->setRelations([]);
         $database->makeHidden(['destination', 'source', 'environment', 'environment_variables', 'environment_variables_preview']);
 
-        return $this->respond(
+        return $this->mcpSuccess($request, $this->respond(
             $this->scrubSensitive($database->toArray()),
             $this->actionsForDatabase($uuid, $database->status ?? null),
-        );
+        ), ['resource_uuid' => $uuid]);
     }
 
     public function schema(JsonSchema $schema): array
diff --git a/app/Mcp/Tools/GetInfrastructureOverview.php b/app/Mcp/Tools/GetInfrastructureOverview.php
index 06e91ff57..6fcafa316 100644
--- a/app/Mcp/Tools/GetInfrastructureOverview.php
+++ b/app/Mcp/Tools/GetInfrastructureOverview.php
@@ -9,26 +9,26 @@ use App\Models\Server;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('get_infrastructure_overview')]
-#[Description('High-level overview of the authenticated team: Coolify version, all servers, projects with resource counts, and aggregate counts. Start here to understand the setup.')]
 class GetInfrastructureOverview extends Tool
 {
+    protected string $name = 'get_infrastructure_overview';
+
+    protected string $description = 'High-level overview of the authenticated team: Coolify version, all servers, projects with resource counts, and aggregate counts. Start here to understand the setup.';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $servers = Server::whereTeamId($teamId)
@@ -72,7 +72,7 @@ class GetInfrastructureOverview extends Tool
             ];
         }
 
-        return $this->respond([
+        return $this->mcpSuccess($request, $this->respond([
             'coolify_version' => config('constants.coolify.version'),
             'servers' => $servers,
             'projects' => $projectSummaries,
@@ -83,7 +83,7 @@ class GetInfrastructureOverview extends Tool
                 'services' => $serviceCount,
                 'databases' => $databaseCount,
             ],
-        ]);
+        ]));
     }
 
     public function schema(JsonSchema $schema): array
diff --git a/app/Mcp/Tools/GetServer.php b/app/Mcp/Tools/GetServer.php
index fc3e72f14..771aa7d36 100644
--- a/app/Mcp/Tools/GetServer.php
+++ b/app/Mcp/Tools/GetServer.php
@@ -8,36 +8,36 @@ use App\Models\Server;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('get_server')]
-#[Description('Get full details for a single server by UUID.')]
 class GetServer extends Tool
 {
+    protected string $name = 'get_server';
+
+    protected string $description = 'Get full details for a single server by UUID.';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $uuid = $request->get('uuid');
         if (! is_string($uuid) || $uuid === '') {
-            return Response::error('uuid argument is required.');
+            return $this->mcpError($request, 'uuid argument is required.');
         }
 
         $server = Server::whereTeamId($teamId)->where('uuid', $uuid)->with('settings')->first();
         if (! $server) {
-            return Response::error("Server [{$uuid}] not found.");
+            return $this->mcpError($request, "Server [{$uuid}] not found.", ['resource_uuid' => $uuid]);
         }
 
         $data = $this->scrubSensitive($server->toArray());
@@ -45,7 +45,7 @@ class GetServer extends Tool
         $data['is_usable'] = $server->settings?->is_usable;
         $data['connection_timeout'] = $server->settings?->connection_timeout;
 
-        return $this->respond($data, $this->actionsForServer($uuid));
+        return $this->mcpSuccess($request, $this->respond($data, $this->actionsForServer($uuid)), ['resource_uuid' => $uuid]);
     }
 
     public function schema(JsonSchema $schema): array
diff --git a/app/Mcp/Tools/GetService.php b/app/Mcp/Tools/GetService.php
index 475958272..ad14ddb49 100644
--- a/app/Mcp/Tools/GetService.php
+++ b/app/Mcp/Tools/GetService.php
@@ -8,31 +8,31 @@ use App\Models\Service;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('get_service')]
-#[Description('Get full details for a single service (multi-container stack) by UUID.')]
 class GetService extends Tool
 {
+    protected string $name = 'get_service';
+
+    protected string $description = 'Get full details for a single service (multi-container stack) by UUID.';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $uuid = $request->get('uuid');
         if (! is_string($uuid) || $uuid === '') {
-            return Response::error('uuid argument is required.');
+            return $this->mcpError($request, 'uuid argument is required.');
         }
 
         $service = Service::whereRelation('environment.project.team', 'id', $teamId)
@@ -40,16 +40,16 @@ class GetService extends Tool
             ->first();
 
         if (! $service) {
-            return Response::error("Service [{$uuid}] not found.");
+            return $this->mcpError($request, "Service [{$uuid}] not found.", ['resource_uuid' => $uuid]);
         }
 
         $service->setRelations([]);
         $service->makeHidden(['destination', 'source', 'environment', 'applications', 'databases', 'serviceApplications', 'serviceDatabases']);
 
-        return $this->respond(
+        return $this->mcpSuccess($request, $this->respond(
             $this->scrubSensitive($service->toArray()),
             $this->actionsForService($uuid, $service->status ?? null),
-        );
+        ), ['resource_uuid' => $uuid]);
     }
 
     public function schema(JsonSchema $schema): array
diff --git a/app/Mcp/Tools/ListApplications.php b/app/Mcp/Tools/ListApplications.php
index 815edd61a..bf31131b2 100644
--- a/app/Mcp/Tools/ListApplications.php
+++ b/app/Mcp/Tools/ListApplications.php
@@ -8,31 +8,31 @@ use App\Models\Application;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('list_applications')]
-#[Description('List applications owned by the authenticated team. Returns summary (uuid, name, status, fqdn, git_repository). Optional "tag" argument filters by tag name. Use get_application for full details.')]
 class ListApplications extends Tool
 {
+    protected string $name = 'list_applications';
+
+    protected string $description = 'List applications owned by the authenticated team. Returns summary (uuid, name, status, fqdn, git_repository). Optional "tag" argument filters by tag name. Use get_application for full details.';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $tagName = $request->get('tag');
         if ($tagName !== null && (! is_string($tagName) || trim($tagName) === '')) {
-            return Response::error('tag argument must be a non-empty string.');
+            return $this->mcpError($request, 'tag argument must be a non-empty string.');
         }
         $args = $this->paginationArgs($request);
 
@@ -59,11 +59,11 @@ class ListApplications extends Tool
 
         $extra = $tagName ? ['tag' => $tagName] : [];
 
-        return $this->respond(
+        return $this->mcpSuccess($request, $this->respond(
             $summaries,
             [],
             $this->paginationMeta('list_applications', $args, $total, $extra),
-        );
+        ));
     }
 
     public function schema(JsonSchema $schema): array
diff --git a/app/Mcp/Tools/ListDatabases.php b/app/Mcp/Tools/ListDatabases.php
index 7eb1fde00..98de6ecee 100644
--- a/app/Mcp/Tools/ListDatabases.php
+++ b/app/Mcp/Tools/ListDatabases.php
@@ -8,26 +8,26 @@ use App\Models\Project;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('list_databases')]
-#[Description('List standalone databases owned by the authenticated team. Returns summary (uuid, name, status, type). Use get_database for full details.')]
 class ListDatabases extends Tool
 {
+    protected string $name = 'list_databases';
+
+    protected string $description = 'List standalone databases owned by the authenticated team. Returns summary (uuid, name, status, type). Use get_database for full details.';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $args = $this->paginationArgs($request);
@@ -52,11 +52,11 @@ class ListDatabases extends Tool
             ->values()
             ->all();
 
-        return $this->respond(
+        return $this->mcpSuccess($request, $this->respond(
             $summaries,
             [],
             $this->paginationMeta('list_databases', $args, $total),
-        );
+        ));
     }
 
     public function schema(JsonSchema $schema): array
diff --git a/app/Mcp/Tools/ListProjects.php b/app/Mcp/Tools/ListProjects.php
index 9ce1576b9..0a6de7f60 100644
--- a/app/Mcp/Tools/ListProjects.php
+++ b/app/Mcp/Tools/ListProjects.php
@@ -8,26 +8,26 @@ use App\Models\Project;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('list_projects')]
-#[Description('List projects owned by the authenticated team. Returns summary (uuid, name, description).')]
 class ListProjects extends Tool
 {
+    protected string $name = 'list_projects';
+
+    protected string $description = 'List projects owned by the authenticated team. Returns summary (uuid, name, description).';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $args = $this->paginationArgs($request);
@@ -49,11 +49,11 @@ class ListProjects extends Tool
             ->values()
             ->all();
 
-        return $this->respond(
+        return $this->mcpSuccess($request, $this->respond(
             $summaries,
             [],
             $this->paginationMeta('list_projects', $args, $total),
-        );
+        ));
     }
 
     public function schema(JsonSchema $schema): array
diff --git a/app/Mcp/Tools/ListServers.php b/app/Mcp/Tools/ListServers.php
index 20250c454..ed10afc93 100644
--- a/app/Mcp/Tools/ListServers.php
+++ b/app/Mcp/Tools/ListServers.php
@@ -8,26 +8,26 @@ use App\Models\Server;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('list_servers')]
-#[Description('List servers visible to the authenticated team token. Returns summary (uuid, name, ip, reachability). Use get_server for full details.')]
 class ListServers extends Tool
 {
+    protected string $name = 'list_servers';
+
+    protected string $description = 'List servers visible to the authenticated team token. Returns summary (uuid, name, ip, reachability). Use get_server for full details.';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $args = $this->paginationArgs($request);
@@ -50,11 +50,11 @@ class ListServers extends Tool
             ->values()
             ->all();
 
-        return $this->respond(
+        return $this->mcpSuccess($request, $this->respond(
             $summaries,
             [],
             $this->paginationMeta('list_servers', $args, $total),
-        );
+        ));
     }
 
     public function schema(JsonSchema $schema): array
diff --git a/app/Mcp/Tools/ListServices.php b/app/Mcp/Tools/ListServices.php
index b0bff4fad..3a0ea158a 100644
--- a/app/Mcp/Tools/ListServices.php
+++ b/app/Mcp/Tools/ListServices.php
@@ -8,26 +8,26 @@ use App\Models\Service;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('list_services')]
-#[Description('List services (multi-container stacks) owned by the authenticated team. Returns summary (uuid, name, status). Use get_service for full details.')]
 class ListServices extends Tool
 {
+    protected string $name = 'list_services';
+
+    protected string $description = 'List services (multi-container stacks) owned by the authenticated team. Returns summary (uuid, name, status). Use get_service for full details.';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $args = $this->paginationArgs($request);
@@ -49,11 +49,11 @@ class ListServices extends Tool
             ->values()
             ->all();
 
-        return $this->respond(
+        return $this->mcpSuccess($request, $this->respond(
             $summaries,
             [],
             $this->paginationMeta('list_services', $args, $total),
-        );
+        ));
     }
 
     public function schema(JsonSchema $schema): array
diff --git a/app/Models/Application.php b/app/Models/Application.php
index a6f4b8892..ebfa2cd9b 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -23,7 +23,6 @@ use RuntimeException;
 use Spatie\Activitylog\Models\Activity;
 use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
-use Visus\Cuid2\Cuid2;
 
 #[OA\Schema(
     description: 'Application model',
@@ -1945,7 +1944,7 @@ class Application extends BaseModel
         if ($isInit && $this->docker_compose_raw) {
             return;
         }
-        $uuid = new Cuid2;
+        $uuid = new_public_id();
         ['commands' => $cloneCommand] = $this->generateGitImportCommands(deployment_uuid: $uuid, only_checkout: true, exec_in_docker: false, custom_base_dir: 'checkout');
         $cloneCommand = str_replace(' clone ', ' clone --quiet ', $cloneCommand);
         $workdir = rtrim($this->base_directory, '/');
diff --git a/app/Models/ApplicationPreview.php b/app/Models/ApplicationPreview.php
index 9159fd0d8..6e4b696d5 100644
--- a/app/Models/ApplicationPreview.php
+++ b/app/Models/ApplicationPreview.php
@@ -5,7 +5,6 @@ namespace App\Models;
 use App\Support\ValidationPatterns;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Spatie\Url\Url;
-use Visus\Cuid2\Cuid2;
 
 class ApplicationPreview extends BaseModel
 {
@@ -111,7 +110,7 @@ class ApplicationPreview extends BaseModel
             $port = $portInt !== null ? ':'.$portInt : '';
             $urlPath = $url->getPath();
             $path = ($urlPath !== '' && $urlPath !== '/') ? $urlPath : '';
-            $random = new Cuid2;
+            $random = new_public_id();
             $preview_fqdn = str_replace('{{random}}', $random, $template);
             $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
             $preview_fqdn = str_replace('{{pr_id}}', $this->pull_request_id, $preview_fqdn);
@@ -173,7 +172,7 @@ class ApplicationPreview extends BaseModel
                 $port = $portInt !== null ? ':'.$portInt : '';
                 $urlPath = $url->getPath();
                 $path = ($urlPath !== '' && $urlPath !== '/') ? $urlPath : '';
-                $random = new Cuid2;
+                $random = new_public_id();
                 $preview_fqdn = str_replace('{{random}}', $random, $template);
                 $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
                 $preview_fqdn = str_replace('{{pr_id}}', $this->pull_request_id, $preview_fqdn);
diff --git a/app/Models/BaseModel.php b/app/Models/BaseModel.php
index 727abed5f..d657fbec4 100644
--- a/app/Models/BaseModel.php
+++ b/app/Models/BaseModel.php
@@ -4,7 +4,6 @@ namespace App\Models;
 
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
-use Visus\Cuid2\Cuid2;
 
 abstract class BaseModel extends Model
 {
@@ -15,7 +14,7 @@ abstract class BaseModel extends Model
         static::creating(function (Model $model) {
             // Generate a UUID if one isn't set
             if (! $model->uuid) {
-                $model->uuid = (string) new Cuid2;
+                $model->uuid = new_public_id();
             }
         });
     }
diff --git a/app/Models/PrivateKey.php b/app/Models/PrivateKey.php
index ee330aa19..d16213ad7 100644
--- a/app/Models/PrivateKey.php
+++ b/app/Models/PrivateKey.php
@@ -4,6 +4,7 @@ namespace App\Models;
 
 use App\Traits\HasSafeStringAttribute;
 use DanHarrin\LivewireRateLimiting\WithRateLimiting;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Storage;
@@ -30,7 +31,7 @@ use phpseclib3\Crypt\PublicKeyLoader;
 )]
 class PrivateKey extends BaseModel
 {
-    use HasSafeStringAttribute, WithRateLimiting;
+    use HasFactory, HasSafeStringAttribute, WithRateLimiting;
 
     protected $fillable = [
         'name',
diff --git a/app/Models/Project.php b/app/Models/Project.php
index 236ef3a26..5c821b017 100644
--- a/app/Models/Project.php
+++ b/app/Models/Project.php
@@ -7,7 +7,6 @@ use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Support\Collection;
 use OpenApi\Attributes as OA;
-use Visus\Cuid2\Cuid2;
 
 #[OA\Schema(
     description: 'Project model',
@@ -60,7 +59,7 @@ class Project extends BaseModel
             Environment::create([
                 'name' => 'production',
                 'project_id' => $project->id,
-                'uuid' => (string) new Cuid2,
+                'uuid' => new_public_id(),
             ]);
         });
         static::deleting(function ($project) {
diff --git a/app/Models/S3Storage.php b/app/Models/S3Storage.php
index 5e21ed3b1..69eb4fc48 100644
--- a/app/Models/S3Storage.php
+++ b/app/Models/S3Storage.php
@@ -181,21 +181,25 @@ class S3Storage extends BaseModel
             $exception = $this->toUserFriendlyConnectionException($e);
             $this->is_usable = false;
             if ($this->unusable_email_sent === false && is_transactional_emails_enabled()) {
-                $mail = new MailMessage;
-                $mail->subject('Coolify: S3 Storage Connection Error');
-                $mail->view('emails.s3-connection-error', ['name' => $this->name, 'reason' => $exception->getMessage(), 'url' => route('storage.show', ['storage_uuid' => $this->uuid])]);
+                try {
+                    $mail = new MailMessage;
+                    $mail->subject('Coolify: S3 Storage Connection Error');
+                    $mail->view('emails.s3-connection-error', ['name' => $this->name, 'reason' => $exception->getMessage(), 'url' => route('storage.show', ['storage_uuid' => $this->uuid])]);
 
-                // Load the team with its members and their roles explicitly
-                $team = $this->team()->with(['members' => function ($query) {
-                    $query->withPivot('role');
-                }])->first();
+                    // Load the team with its members and their roles explicitly
+                    $team = $this->team()->with(['members' => function ($query) {
+                        $query->withPivot('role');
+                    }])->first();
 
-                // Get admins directly from the pivot relationship for this specific team
-                $users = $team->members()->wherePivotIn('role', ['admin', 'owner'])->get(['users.id', 'users.email']);
-                foreach ($users as $user) {
-                    send_user_an_email($mail, $user->email);
+                    // Get admins directly from the pivot relationship for this specific team
+                    $users = $team->members()->wherePivotIn('role', ['admin', 'owner'])->get(['users.id', 'users.email']);
+                    foreach ($users as $user) {
+                        send_user_an_email($mail, $user->email);
+                    }
+                    $this->unusable_email_sent = true;
+                } catch (\Throwable $emailException) {
+                    \Log::warning('Failed to send S3 connection error notification: '.$emailException->getMessage());
                 }
-                $this->unusable_email_sent = true;
             }
 
             throw $exception;
diff --git a/app/Models/Server.php b/app/Models/Server.php
index 20a4ee95b..7dd2bd472 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -37,7 +37,6 @@ use Spatie\SchemalessAttributes\SchemalessAttributesTrait;
 use Spatie\Url\Url;
 use Stevebauman\Purify\Facades\Purify;
 use Symfony\Component\Yaml\Yaml;
-use Visus\Cuid2\Cuid2;
 
 /**
  * @property array{
@@ -1051,7 +1050,7 @@ $schema://$host {
     {
         $attributes = [
             'name' => 'coolify',
-            'uuid' => (string) new Cuid2,
+            'uuid' => new_public_id(),
             'network' => 'coolify',
             'server_id' => $this->id,
         ];
diff --git a/app/Models/Service.php b/app/Models/Service.php
index a4ceb01f1..d2de68c7d 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -16,7 +16,6 @@ use OpenApi\Attributes as OA;
 use Spatie\Activitylog\Models\Activity;
 use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
-use Visus\Cuid2\Cuid2;
 
 #[OA\Schema(
     description: 'Service model',
@@ -82,7 +81,7 @@ class Service extends BaseModel
     {
         static::creating(function ($service) {
             if (blank($service->name)) {
-                $service->name = 'service-'.(new Cuid2);
+                $service->name = 'service-'.new_public_id();
             }
         });
         static::created(function ($service) {
@@ -1575,7 +1574,7 @@ class Service extends BaseModel
             "cd $workdir",
         ], $this->server);
 
-        $filename = new Cuid2.'-docker-compose.yml';
+        $filename = new_public_id().'-docker-compose.yml';
         Storage::disk('local')->put("tmp/{$filename}", $this->docker_compose);
         $path = Storage::path("tmp/{$filename}");
         instant_scp($path, "{$workdir}/docker-compose.yml", $this->server);
diff --git a/app/Models/Team.php b/app/Models/Team.php
index f0a50cf69..23e2badb3 100644
--- a/app/Models/Team.php
+++ b/app/Models/Team.php
@@ -66,7 +66,7 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
             $team->webhookNotificationSettings()->create();
         });
 
-        static::saving(function ($team) {
+        static::updating(function ($team) {
             if (auth()->user()?->isMember()) {
                 throw new \Exception('You are not allowed to update this team.');
             }
diff --git a/app/Models/User.php b/app/Models/User.php
index 9cbe88835..b59b553d9 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -349,6 +349,11 @@ class User extends Authenticatable implements SendsEmail
     {
         $sessionTeamId = data_get(session('currentTeam'), 'id');
 
+        // Fallback for stateless API requests: resolve team from Sanctum token
+        if (is_null($sessionTeamId) && $this->currentAccessToken()) {
+            $sessionTeamId = data_get($this->currentAccessToken(), 'team_id');
+        }
+
         if (is_null($sessionTeamId)) {
             return null;
         }
diff --git a/app/Policies/ApiTokenPolicy.php b/app/Policies/ApiTokenPolicy.php
index 761227118..ba9bade01 100644
--- a/app/Policies/ApiTokenPolicy.php
+++ b/app/Policies/ApiTokenPolicy.php
@@ -12,11 +12,6 @@ class ApiTokenPolicy
      */
     public function viewAny(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // Users can view their own API tokens
-        return true;
-        */
         return true;
     }
 
@@ -25,12 +20,7 @@ class ApiTokenPolicy
      */
     public function view(User $user, PersonalAccessToken $token): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // Users can only view their own tokens
         return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
-        */
-        return true;
     }
 
     /**
@@ -38,11 +28,6 @@ class ApiTokenPolicy
      */
     public function create(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // All authenticated users can create their own API tokens
-        return true;
-        */
         return true;
     }
 
@@ -51,12 +36,7 @@ class ApiTokenPolicy
      */
     public function update(User $user, PersonalAccessToken $token): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // Users can only update their own tokens
         return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
-        */
-        return true;
     }
 
     /**
@@ -64,12 +44,7 @@ class ApiTokenPolicy
      */
     public function delete(User $user, PersonalAccessToken $token): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // Users can only delete their own tokens
         return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
-        */
-        return true;
     }
 
     /**
@@ -77,11 +52,6 @@ class ApiTokenPolicy
      */
     public function manage(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // All authenticated users can manage their own API tokens
-        return true;
-        */
         return true;
     }
 
@@ -90,7 +60,6 @@ class ApiTokenPolicy
      */
     public function useRootPermissions(User $user): bool
     {
-        // Only admins and owners can use root permissions
         return $user->isAdmin() || $user->isOwner();
     }
 
@@ -99,11 +68,22 @@ class ApiTokenPolicy
      */
     public function useWritePermissions(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        // Only admins and owners can use write permissions
         return $user->isAdmin() || $user->isOwner();
-        */
-        return true;
+    }
+
+    /**
+     * Determine whether the user can use deploy permissions for API tokens.
+     */
+    public function useDeployPermissions(User $user): bool
+    {
+        return $user->isAdmin() || $user->isOwner();
+    }
+
+    /**
+     * Determine whether the user can use read:sensitive permissions for API tokens.
+     */
+    public function useSensitivePermissions(User $user): bool
+    {
+        return $user->isAdmin() || $user->isOwner();
     }
 }
diff --git a/app/Policies/ApplicationPolicy.php b/app/Policies/ApplicationPolicy.php
index d64a436ad..1a1290b55 100644
--- a/app/Policies/ApplicationPolicy.php
+++ b/app/Policies/ApplicationPolicy.php
@@ -13,10 +13,6 @@ class ApplicationPolicy
      */
     public function viewAny(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return true;
-        */
         return true;
     }
 
@@ -25,11 +21,9 @@ class ApplicationPolicy
      */
     public function view(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return true;
-        */
-        return true;
+        $teamId = $this->getTeamId($application);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -37,15 +31,7 @@ class ApplicationPolicy
      */
     public function create(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
-        if ($user->isAdmin()) {
-            return true;
-        }
-
-        return false;
-        */
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -53,15 +39,17 @@ class ApplicationPolicy
      */
     public function update(User $user, Application $application): Response
     {
-        // Authorization temporarily disabled
-        /*
-        if ($user->isAdmin()) {
+        $teamId = $this->getTeamId($application);
+
+        if ($teamId === null) {
+            return Response::deny('Application team not found.');
+        }
+
+        if ($user->isAdminOfTeam($teamId)) {
             return Response::allow();
         }
 
-        return Response::deny('As a member, you cannot update this application.<br/><br/>You need at least admin or owner permissions.');
-        */
-        return Response::allow();
+        return Response::deny('You need at least admin or owner permissions to update this application.');
     }
 
     /**
@@ -69,15 +57,9 @@ class ApplicationPolicy
      */
     public function delete(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        if ($user->isAdmin()) {
-            return true;
-        }
+        $teamId = $this->getTeamId($application);
 
-        return false;
-        */
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -85,11 +67,7 @@ class ApplicationPolicy
      */
     public function restore(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return true;
-        */
-        return true;
+        return false;
     }
 
     /**
@@ -97,11 +75,25 @@ class ApplicationPolicy
      */
     public function forceDelete(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return $user->isAdmin() && $user->teams->contains('id', $application->team()->first()->id);
-        */
-        return true;
+        return false;
+    }
+
+    /**
+     * Determine whether the user can upload a backup archive for this application.
+     */
+    public function uploadBackup(User $user, Application $application): Response
+    {
+        $teamId = $this->getTeamId($application);
+
+        if ($teamId === null) {
+            return Response::deny('Application team not found.');
+        }
+
+        if ($user->isAdminOfTeam($teamId)) {
+            return Response::allow();
+        }
+
+        return Response::deny('You need at least admin or owner permissions to upload backups for this application.');
     }
 
     /**
@@ -109,11 +101,9 @@ class ApplicationPolicy
      */
     public function deploy(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return $user->teams->contains('id', $application->team()->first()->id);
-        */
-        return true;
+        $teamId = $this->getTeamId($application);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -121,11 +111,9 @@ class ApplicationPolicy
      */
     public function manageDeployments(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return $user->isAdmin() && $user->teams->contains('id', $application->team()->first()->id);
-        */
-        return true;
+        $teamId = $this->getTeamId($application);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -133,11 +121,9 @@ class ApplicationPolicy
      */
     public function manageEnvironment(User $user, Application $application): bool
     {
-        // Authorization temporarily disabled
-        /*
-        return $user->isAdmin() && $user->teams->contains('id', $application->team()->first()->id);
-        */
-        return true;
+        $teamId = $this->getTeamId($application);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -145,10 +131,11 @@ class ApplicationPolicy
      */
     public function cleanupDeploymentQueue(User $user): bool
     {
-        // Authorization temporarily disabled
-        /*
         return $user->isAdmin();
-        */
-        return true;
+    }
+
+    private function getTeamId(Application $application): ?int
+    {
+        return $application->team()?->id;
     }
 }
diff --git a/app/Policies/ApplicationPreviewPolicy.php b/app/Policies/ApplicationPreviewPolicy.php
index 4d371cc38..f3c13acd9 100644
--- a/app/Policies/ApplicationPreviewPolicy.php
+++ b/app/Policies/ApplicationPreviewPolicy.php
@@ -21,8 +21,9 @@ class ApplicationPreviewPolicy
      */
     public function view(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationPreview);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -30,21 +31,25 @@ class ApplicationPreviewPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
      * Determine whether the user can update the model.
      */
-    public function update(User $user, ApplicationPreview $applicationPreview)
+    public function update(User $user, ApplicationPreview $applicationPreview): Response
     {
-        // if ($user->isAdmin()) {
-        //    return Response::allow();
-        // }
+        $teamId = $this->getTeamId($applicationPreview);
 
-        // return Response::deny('As a member, you cannot update this preview.<br/><br/>You need at least admin or owner permissions.');
-        return true;
+        if ($teamId === null) {
+            return Response::deny('Application preview team not found.');
+        }
+
+        if ($user->isAdminOfTeam($teamId)) {
+            return Response::allow();
+        }
+
+        return Response::deny('You need at least admin or owner permissions to update this preview.');
     }
 
     /**
@@ -52,8 +57,9 @@ class ApplicationPreviewPolicy
      */
     public function delete(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationPreview);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -61,8 +67,7 @@ class ApplicationPreviewPolicy
      */
     public function restore(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        return false;
     }
 
     /**
@@ -70,8 +75,7 @@ class ApplicationPreviewPolicy
      */
     public function forceDelete(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        return false;
     }
 
     /**
@@ -79,8 +83,9 @@ class ApplicationPreviewPolicy
      */
     public function deploy(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationPreview);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -88,7 +93,13 @@ class ApplicationPreviewPolicy
      */
     public function manageDeployments(User $user, ApplicationPreview $applicationPreview): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationPreview);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
+    }
+
+    private function getTeamId(ApplicationPreview $applicationPreview): ?int
+    {
+        return $applicationPreview->application?->team()?->id;
     }
 }
diff --git a/app/Policies/ApplicationSettingPolicy.php b/app/Policies/ApplicationSettingPolicy.php
index 848dc9aee..be2137cb8 100644
--- a/app/Policies/ApplicationSettingPolicy.php
+++ b/app/Policies/ApplicationSettingPolicy.php
@@ -20,8 +20,9 @@ class ApplicationSettingPolicy
      */
     public function view(User $user, ApplicationSetting $applicationSetting): bool
     {
-        // return $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationSetting);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -29,8 +30,7 @@ class ApplicationSettingPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -38,8 +38,9 @@ class ApplicationSettingPolicy
      */
     public function update(User $user, ApplicationSetting $applicationSetting): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationSetting);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -47,8 +48,9 @@ class ApplicationSettingPolicy
      */
     public function delete(User $user, ApplicationSetting $applicationSetting): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($applicationSetting);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -56,8 +58,7 @@ class ApplicationSettingPolicy
      */
     public function restore(User $user, ApplicationSetting $applicationSetting): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
-        return true;
+        return false;
     }
 
     /**
@@ -65,7 +66,11 @@ class ApplicationSettingPolicy
      */
     public function forceDelete(User $user, ApplicationSetting $applicationSetting): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
-        return true;
+        return false;
+    }
+
+    private function getTeamId(ApplicationSetting $applicationSetting): ?int
+    {
+        return $applicationSetting->application?->team()?->id;
     }
 }
diff --git a/app/Policies/DatabasePolicy.php b/app/Policies/DatabasePolicy.php
index f8e8af637..4217432b5 100644
--- a/app/Policies/DatabasePolicy.php
+++ b/app/Policies/DatabasePolicy.php
@@ -20,8 +20,9 @@ class DatabasePolicy
      */
     public function view(User $user, $database): bool
     {
-        // return $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($database);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -29,21 +30,25 @@ class DatabasePolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
      * Determine whether the user can update the model.
      */
-    public function update(User $user, $database)
+    public function update(User $user, $database): Response
     {
-        // if ($user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id)) {
-        //    return Response::allow();
-        // }
+        $teamId = $this->getTeamId($database);
 
-        // return Response::deny('As a member, you cannot update this database.<br/><br/>You need at least admin or owner permissions.');
-        return true;
+        if ($teamId === null) {
+            return Response::deny('Database team not found.');
+        }
+
+        if ($user->isAdminOfTeam($teamId)) {
+            return Response::allow();
+        }
+
+        return Response::deny('You need at least admin or owner permissions to update this database.');
     }
 
     /**
@@ -51,8 +56,9 @@ class DatabasePolicy
      */
     public function delete(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($database);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -60,8 +66,7 @@ class DatabasePolicy
      */
     public function restore(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        return false;
     }
 
     /**
@@ -69,8 +74,7 @@ class DatabasePolicy
      */
     public function forceDelete(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        return false;
     }
 
     /**
@@ -78,8 +82,27 @@ class DatabasePolicy
      */
     public function manage(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($database);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
+    }
+
+    /**
+     * Determine whether the user can upload a backup archive for this database.
+     */
+    public function uploadBackup(User $user, $database): Response
+    {
+        $teamId = $this->getTeamId($database);
+
+        if ($teamId === null) {
+            return Response::deny('Database team not found.');
+        }
+
+        if ($user->isAdminOfTeam($teamId)) {
+            return Response::allow();
+        }
+
+        return Response::deny('You need at least admin or owner permissions to upload backups for this database.');
     }
 
     /**
@@ -87,8 +110,9 @@ class DatabasePolicy
      */
     public function manageBackups(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($database);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -96,7 +120,22 @@ class DatabasePolicy
      */
     public function manageEnvironment(User $user, $database): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
-        return true;
+        $teamId = $this->getTeamId($database);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
+    }
+
+    private function getTeamId($database): ?int
+    {
+        // Instance-level databases (e.g., coolify-db) belong to root team
+        if (isset($database->id) && $database->id === 0) {
+            return 0;
+        }
+
+        if (method_exists($database, 'team')) {
+            return $database->team()?->id;
+        }
+
+        return null;
     }
 }
diff --git a/app/Policies/EnvironmentPolicy.php b/app/Policies/EnvironmentPolicy.php
index 7199abb25..e400ec903 100644
--- a/app/Policies/EnvironmentPolicy.php
+++ b/app/Policies/EnvironmentPolicy.php
@@ -20,8 +20,9 @@ class EnvironmentPolicy
      */
     public function view(User $user, Environment $environment): bool
     {
-        // return $user->teams->contains('id', $environment->project->team_id);
-        return true;
+        $teamId = $this->getTeamId($environment);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -29,8 +30,7 @@ class EnvironmentPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -38,8 +38,9 @@ class EnvironmentPolicy
      */
     public function update(User $user, Environment $environment): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
-        return true;
+        $teamId = $this->getTeamId($environment);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -47,8 +48,9 @@ class EnvironmentPolicy
      */
     public function delete(User $user, Environment $environment): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
-        return true;
+        $teamId = $this->getTeamId($environment);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -56,8 +58,7 @@ class EnvironmentPolicy
      */
     public function restore(User $user, Environment $environment): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
-        return true;
+        return false;
     }
 
     /**
@@ -65,7 +66,11 @@ class EnvironmentPolicy
      */
     public function forceDelete(User $user, Environment $environment): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
-        return true;
+        return false;
+    }
+
+    private function getTeamId(Environment $environment): ?int
+    {
+        return $environment->project?->team_id;
     }
 }
diff --git a/app/Policies/EnvironmentVariablePolicy.php b/app/Policies/EnvironmentVariablePolicy.php
index 21e2ea443..dd0f58918 100644
--- a/app/Policies/EnvironmentVariablePolicy.php
+++ b/app/Policies/EnvironmentVariablePolicy.php
@@ -20,7 +20,9 @@ class EnvironmentVariablePolicy
      */
     public function view(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        $teamId = $this->getTeamId($environmentVariable);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -28,7 +30,7 @@ class EnvironmentVariablePolicy
      */
     public function create(User $user): bool
     {
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -36,7 +38,9 @@ class EnvironmentVariablePolicy
      */
     public function update(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        $teamId = $this->getTeamId($environmentVariable);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -44,7 +48,9 @@ class EnvironmentVariablePolicy
      */
     public function delete(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        $teamId = $this->getTeamId($environmentVariable);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -52,7 +58,7 @@ class EnvironmentVariablePolicy
      */
     public function restore(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        return false;
     }
 
     /**
@@ -60,7 +66,7 @@ class EnvironmentVariablePolicy
      */
     public function forceDelete(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        return false;
     }
 
     /**
@@ -68,6 +74,19 @@ class EnvironmentVariablePolicy
      */
     public function manageEnvironment(User $user, EnvironmentVariable $environmentVariable): bool
     {
-        return true;
+        $teamId = $this->getTeamId($environmentVariable);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
+    }
+
+    private function getTeamId(EnvironmentVariable $environmentVariable): ?int
+    {
+        $resource = $environmentVariable->resourceable;
+
+        if (! $resource || ! method_exists($resource, 'team')) {
+            return null;
+        }
+
+        return $resource->team()?->id;
     }
 }
diff --git a/app/Policies/GithubAppPolicy.php b/app/Policies/GithubAppPolicy.php
index 56bec7032..79dd79838 100644
--- a/app/Policies/GithubAppPolicy.php
+++ b/app/Policies/GithubAppPolicy.php
@@ -20,8 +20,11 @@ class GithubAppPolicy
      */
     public function view(User $user, GithubApp $githubApp): bool
     {
-        // return $user->teams->contains('id', $githubApp->team_id) || $githubApp->is_system_wide;
-        return true;
+        if ($githubApp->is_system_wide) {
+            return true;
+        }
+
+        return $user->teams->contains('id', $githubApp->team_id);
     }
 
     /**
@@ -29,8 +32,7 @@ class GithubAppPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -39,12 +41,10 @@ class GithubAppPolicy
     public function update(User $user, GithubApp $githubApp): bool
     {
         if ($githubApp->is_system_wide) {
-            // return $user->isAdmin();
-            return true;
+            return $user->canAccessSystemResources();
         }
 
-        // return $user->isAdmin() && $user->teams->contains('id', $githubApp->team_id);
-        return true;
+        return $user->isAdminOfTeam($githubApp->team_id);
     }
 
     /**
@@ -53,12 +53,10 @@ class GithubAppPolicy
     public function delete(User $user, GithubApp $githubApp): bool
     {
         if ($githubApp->is_system_wide) {
-            // return $user->isAdmin();
-            return true;
+            return $user->canAccessSystemResources();
         }
 
-        // return $user->isAdmin() && $user->teams->contains('id', $githubApp->team_id);
-        return true;
+        return $user->isAdminOfTeam($githubApp->team_id);
     }
 
     /**
diff --git a/app/Policies/NotificationPolicy.php b/app/Policies/NotificationPolicy.php
index 4f3be431d..e8764bf13 100644
--- a/app/Policies/NotificationPolicy.php
+++ b/app/Policies/NotificationPolicy.php
@@ -12,13 +12,11 @@ class NotificationPolicy
      */
     public function view(User $user, Model $notificationSettings): bool
     {
-        // Check if the notification settings belong to the user's current team
         if (! $notificationSettings->team) {
             return false;
         }
 
-        // return $user->teams()->where('teams.id', $notificationSettings->team->id)->exists();
-        return true;
+        return $user->teams->contains('id', $notificationSettings->team->id);
     }
 
     /**
@@ -26,14 +24,13 @@ class NotificationPolicy
      */
     public function update(User $user, Model $notificationSettings): bool
     {
-        // Check if the notification settings belong to the user's current team
         if (! $notificationSettings->team) {
             return false;
         }
 
-        // Only owners and admins can update notification settings
-        //  return $user->isAdmin() || $user->isOwner();
-        return true;
+        $teamId = $notificationSettings->team->id;
+
+        return $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -41,8 +38,7 @@ class NotificationPolicy
      */
     public function manage(User $user, Model $notificationSettings): bool
     {
-        // return $this->update($user, $notificationSettings);
-        return true;
+        return $this->update($user, $notificationSettings);
     }
 
     /**
@@ -50,7 +46,6 @@ class NotificationPolicy
      */
     public function sendTest(User $user, Model $notificationSettings): bool
     {
-        // return $this->update($user, $notificationSettings);
-        return true;
+        return $this->update($user, $notificationSettings);
     }
 }
diff --git a/app/Policies/ProjectPolicy.php b/app/Policies/ProjectPolicy.php
index e188c293f..9d65b9130 100644
--- a/app/Policies/ProjectPolicy.php
+++ b/app/Policies/ProjectPolicy.php
@@ -20,8 +20,7 @@ class ProjectPolicy
      */
     public function view(User $user, Project $project): bool
     {
-        // return $user->teams->contains('id', $project->team_id);
-        return true;
+        return $user->teams->contains('id', $project->team_id);
     }
 
     /**
@@ -29,8 +28,7 @@ class ProjectPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -38,8 +36,7 @@ class ProjectPolicy
      */
     public function update(User $user, Project $project): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
-        return true;
+        return $user->isAdminOfTeam($project->team_id);
     }
 
     /**
@@ -47,8 +44,7 @@ class ProjectPolicy
      */
     public function delete(User $user, Project $project): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
-        return true;
+        return $user->isAdminOfTeam($project->team_id);
     }
 
     /**
@@ -56,8 +52,7 @@ class ProjectPolicy
      */
     public function restore(User $user, Project $project): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
-        return true;
+        return false;
     }
 
     /**
@@ -65,7 +60,6 @@ class ProjectPolicy
      */
     public function forceDelete(User $user, Project $project): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
-        return true;
+        return false;
     }
 }
diff --git a/app/Policies/ResourceCreatePolicy.php b/app/Policies/ResourceCreatePolicy.php
index 9ed2b66ab..a7a855402 100644
--- a/app/Policies/ResourceCreatePolicy.php
+++ b/app/Policies/ResourceCreatePolicy.php
@@ -38,8 +38,7 @@ class ResourceCreatePolicy
      */
     public function createAny(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -51,8 +50,7 @@ class ResourceCreatePolicy
             return false;
         }
 
-        //  return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
diff --git a/app/Policies/S3StoragePolicy.php b/app/Policies/S3StoragePolicy.php
index 982c7c523..81cbd164f 100644
--- a/app/Policies/S3StoragePolicy.php
+++ b/app/Policies/S3StoragePolicy.php
@@ -36,8 +36,7 @@ class S3StoragePolicy
      */
     public function update(User $user, S3Storage $storage): bool
     {
-        // return $user->teams->contains('id', $storage->team_id) && $user->isAdmin();
-        return $user->teams->contains('id', $storage->team_id);
+        return $user->teams->contains('id', $storage->team_id) && $user->isAdminOfTeam($storage->team_id);
     }
 
     /**
@@ -45,8 +44,7 @@ class S3StoragePolicy
      */
     public function delete(User $user, S3Storage $storage): bool
     {
-        // return $user->teams->contains('id', $storage->team_id) && $user->isAdmin();
-        return $user->teams->contains('id', $storage->team_id);
+        return $user->teams->contains('id', $storage->team_id) && $user->isAdminOfTeam($storage->team_id);
     }
 
     /**
@@ -70,6 +68,6 @@ class S3StoragePolicy
      */
     public function validateConnection(User $user, S3Storage $storage): bool
     {
-        return $user->teams->contains('id', $storage->team_id);
+        return $user->teams->contains('id', $storage->team_id) && $user->isAdminOfTeam($storage->team_id);
     }
 }
diff --git a/app/Policies/ServerPolicy.php b/app/Policies/ServerPolicy.php
index 6d2396a7d..c1369ce67 100644
--- a/app/Policies/ServerPolicy.php
+++ b/app/Policies/ServerPolicy.php
@@ -28,8 +28,7 @@ class ServerPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -37,8 +36,7 @@ class ServerPolicy
      */
     public function update(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
     }
 
     /**
@@ -46,8 +44,7 @@ class ServerPolicy
      */
     public function delete(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
     }
 
     /**
@@ -71,8 +68,7 @@ class ServerPolicy
      */
     public function manageProxy(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
     }
 
     /**
@@ -80,8 +76,15 @@ class ServerPolicy
      */
     public function manageSentinel(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
+    }
+
+    /**
+     * Determine whether the user can view Sentinel configuration and logs.
+     */
+    public function viewSentinel(User $user, Server $server): bool
+    {
+        return $user->isAdminOfTeam($server->team_id);
     }
 
     /**
@@ -89,8 +92,7 @@ class ServerPolicy
      */
     public function manageCaCertificate(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
     }
 
     /**
@@ -98,7 +100,6 @@ class ServerPolicy
      */
     public function viewSecurity(User $user, Server $server): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
-        return true;
+        return $user->isAdminOfTeam($server->team_id);
     }
 }
diff --git a/app/Policies/ServiceApplicationPolicy.php b/app/Policies/ServiceApplicationPolicy.php
index af380a90f..c730ab0c6 100644
--- a/app/Policies/ServiceApplicationPolicy.php
+++ b/app/Policies/ServiceApplicationPolicy.php
@@ -21,8 +21,7 @@ class ServiceApplicationPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -30,8 +29,7 @@ class ServiceApplicationPolicy
      */
     public function update(User $user, ServiceApplication $serviceApplication): bool
     {
-        // return Gate::allows('update', $serviceApplication->service);
-        return true;
+        return Gate::allows('update', $serviceApplication->service);
     }
 
     /**
@@ -39,8 +37,7 @@ class ServiceApplicationPolicy
      */
     public function delete(User $user, ServiceApplication $serviceApplication): bool
     {
-        // return Gate::allows('delete', $serviceApplication->service);
-        return true;
+        return Gate::allows('delete', $serviceApplication->service);
     }
 
     /**
@@ -48,8 +45,7 @@ class ServiceApplicationPolicy
      */
     public function restore(User $user, ServiceApplication $serviceApplication): bool
     {
-        // return Gate::allows('update', $serviceApplication->service);
-        return true;
+        return false;
     }
 
     /**
@@ -57,7 +53,6 @@ class ServiceApplicationPolicy
      */
     public function forceDelete(User $user, ServiceApplication $serviceApplication): bool
     {
-        // return Gate::allows('delete', $serviceApplication->service);
-        return true;
+        return false;
     }
 }
diff --git a/app/Policies/ServiceDatabasePolicy.php b/app/Policies/ServiceDatabasePolicy.php
index f72f1f327..e94658e29 100644
--- a/app/Policies/ServiceDatabasePolicy.php
+++ b/app/Policies/ServiceDatabasePolicy.php
@@ -13,7 +13,7 @@ class ServiceDatabasePolicy
      */
     public function view(User $user, ServiceDatabase $serviceDatabase): bool
     {
-        return true;
+        return Gate::allows('view', $serviceDatabase->service);
     }
 
     /**
@@ -21,8 +21,7 @@ class ServiceDatabasePolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -30,9 +29,7 @@ class ServiceDatabasePolicy
      */
     public function update(User $user, ServiceDatabase $serviceDatabase): bool
     {
-
-        // return Gate::allows('update', $serviceDatabase->service);
-        return true;
+        return Gate::allows('update', $serviceDatabase->service);
     }
 
     /**
@@ -40,8 +37,7 @@ class ServiceDatabasePolicy
      */
     public function delete(User $user, ServiceDatabase $serviceDatabase): bool
     {
-        // return Gate::allows('delete', $serviceDatabase->service);
-        return true;
+        return Gate::allows('delete', $serviceDatabase->service);
     }
 
     /**
@@ -49,8 +45,7 @@ class ServiceDatabasePolicy
      */
     public function restore(User $user, ServiceDatabase $serviceDatabase): bool
     {
-        // return Gate::allows('update', $serviceDatabase->service);
-        return true;
+        return false;
     }
 
     /**
@@ -58,12 +53,22 @@ class ServiceDatabasePolicy
      */
     public function forceDelete(User $user, ServiceDatabase $serviceDatabase): bool
     {
-        // return Gate::allows('delete', $serviceDatabase->service);
-        return true;
+        return false;
     }
 
+    /**
+     * Determine whether the user can manage database backups.
+     */
     public function manageBackups(User $user, ServiceDatabase $serviceDatabase): bool
     {
-        return true;
+        return Gate::allows('update', $serviceDatabase->service);
+    }
+
+    /**
+     * Determine whether the user can upload a backup archive for this service database.
+     */
+    public function uploadBackup(User $user, ServiceDatabase $serviceDatabase): bool
+    {
+        return Gate::allows('uploadBackup', $serviceDatabase->service);
     }
 }
diff --git a/app/Policies/ServicePolicy.php b/app/Policies/ServicePolicy.php
index 7ab0fe7d0..6ca79b42a 100644
--- a/app/Policies/ServicePolicy.php
+++ b/app/Policies/ServicePolicy.php
@@ -20,7 +20,9 @@ class ServicePolicy
      */
     public function view(User $user, Service $service): bool
     {
-        return true;
+        $teamId = $this->getTeamId($service);
+
+        return $teamId !== null && $user->teams->contains('id', $teamId);
     }
 
     /**
@@ -28,8 +30,7 @@ class ServicePolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -37,13 +38,9 @@ class ServicePolicy
      */
     public function update(User $user, Service $service): bool
     {
-        $team = $service->team();
-        if (! $team) {
-            return false;
-        }
+        $teamId = $this->getTeamId($service);
 
-        // return $user->isAdmin() && $user->teams->contains('id', $team->id);
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -51,12 +48,9 @@ class ServicePolicy
      */
     public function delete(User $user, Service $service): bool
     {
-        // if ($user->isAdmin()) {
-        //    return true;
-        // }
+        $teamId = $this->getTeamId($service);
 
-        // return false;
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -64,8 +58,7 @@ class ServicePolicy
      */
     public function restore(User $user, Service $service): bool
     {
-        // return true;
-        return true;
+        return false;
     }
 
     /**
@@ -73,23 +66,17 @@ class ServicePolicy
      */
     public function forceDelete(User $user, Service $service): bool
     {
-        // if ($user->isAdmin()) {
-        //    return true;
-        // }
-
-        // return false;
-        return true;
+        return false;
     }
 
+    /**
+     * Determine whether the user can stop the service.
+     */
     public function stop(User $user, Service $service): bool
     {
-        $team = $service->team();
-        if (! $team) {
-            return false;
-        }
+        $teamId = $this->getTeamId($service);
 
-        // return $user->teams->contains('id', $team->id);
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -97,13 +84,19 @@ class ServicePolicy
      */
     public function manageEnvironment(User $user, Service $service): bool
     {
-        $team = $service->team();
-        if (! $team) {
-            return false;
-        }
+        $teamId = $this->getTeamId($service);
 
-        // return $user->isAdmin() && $user->teams->contains('id', $team->id);
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
+    }
+
+    /**
+     * Determine whether the user can upload a backup archive for a database within this service.
+     */
+    public function uploadBackup(User $user, Service $service): bool
+    {
+        $teamId = $this->getTeamId($service);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
     /**
@@ -111,18 +104,23 @@ class ServicePolicy
      */
     public function deploy(User $user, Service $service): bool
     {
-        $team = $service->team();
-        if (! $team) {
-            return false;
-        }
+        $teamId = $this->getTeamId($service);
 
-        // return $user->teams->contains('id', $team->id);
-        return true;
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
     }
 
+    /**
+     * Determine whether the user can access the terminal.
+     */
     public function accessTerminal(User $user, Service $service): bool
     {
-        // return $user->isAdmin() || $user->teams->contains('id', $service->team()->id);
-        return true;
+        $teamId = $this->getTeamId($service);
+
+        return $teamId !== null && $user->isAdminOfTeam($teamId);
+    }
+
+    private function getTeamId(Service $service): ?int
+    {
+        return $service->team()?->id;
     }
 }
diff --git a/app/Policies/SharedEnvironmentVariablePolicy.php b/app/Policies/SharedEnvironmentVariablePolicy.php
index b465d8a0c..21b6acb27 100644
--- a/app/Policies/SharedEnvironmentVariablePolicy.php
+++ b/app/Policies/SharedEnvironmentVariablePolicy.php
@@ -28,8 +28,7 @@ class SharedEnvironmentVariablePolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -37,8 +36,7 @@ class SharedEnvironmentVariablePolicy
      */
     public function update(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
-        return true;
+        return $user->isAdminOfTeam($sharedEnvironmentVariable->team_id);
     }
 
     /**
@@ -46,8 +44,7 @@ class SharedEnvironmentVariablePolicy
      */
     public function delete(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
-        return true;
+        return $user->isAdminOfTeam($sharedEnvironmentVariable->team_id);
     }
 
     /**
@@ -55,8 +52,7 @@ class SharedEnvironmentVariablePolicy
      */
     public function restore(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
-        return true;
+        return false;
     }
 
     /**
@@ -64,8 +60,7 @@ class SharedEnvironmentVariablePolicy
      */
     public function forceDelete(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
-        return true;
+        return false;
     }
 
     /**
@@ -73,7 +68,6 @@ class SharedEnvironmentVariablePolicy
      */
     public function manageEnvironment(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
-        return true;
+        return $user->isAdminOfTeam($sharedEnvironmentVariable->team_id);
     }
 }
diff --git a/app/Policies/StandaloneDockerPolicy.php b/app/Policies/StandaloneDockerPolicy.php
index 3e1f83d12..33eda183a 100644
--- a/app/Policies/StandaloneDockerPolicy.php
+++ b/app/Policies/StandaloneDockerPolicy.php
@@ -28,8 +28,7 @@ class StandaloneDockerPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -37,7 +36,7 @@ class StandaloneDockerPolicy
      */
     public function update(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        return $user->teams->contains('id', $standaloneDocker->server->team_id);
+        return $user->isAdminOfTeam($standaloneDocker->server->team_id);
     }
 
     /**
@@ -45,7 +44,7 @@ class StandaloneDockerPolicy
      */
     public function delete(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        return $user->teams->contains('id', $standaloneDocker->server->team_id);
+        return $user->isAdminOfTeam($standaloneDocker->server->team_id);
     }
 
     /**
diff --git a/app/Policies/SwarmDockerPolicy.php b/app/Policies/SwarmDockerPolicy.php
index 82a75910b..b19ab4907 100644
--- a/app/Policies/SwarmDockerPolicy.php
+++ b/app/Policies/SwarmDockerPolicy.php
@@ -28,8 +28,7 @@ class SwarmDockerPolicy
      */
     public function create(User $user): bool
     {
-        // return $user->isAdmin();
-        return true;
+        return $user->isAdmin();
     }
 
     /**
@@ -37,7 +36,7 @@ class SwarmDockerPolicy
      */
     public function update(User $user, SwarmDocker $swarmDocker): bool
     {
-        return $user->teams->contains('id', $swarmDocker->server->team_id);
+        return $user->isAdminOfTeam($swarmDocker->server->team_id);
     }
 
     /**
@@ -45,7 +44,7 @@ class SwarmDockerPolicy
      */
     public function delete(User $user, SwarmDocker $swarmDocker): bool
     {
-        return $user->teams->contains('id', $swarmDocker->server->team_id);
+        return $user->isAdminOfTeam($swarmDocker->server->team_id);
     }
 
     /**
diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php
index e473d2875..5c1a79cf7 100644
--- a/app/Providers/AuthServiceProvider.php
+++ b/app/Providers/AuthServiceProvider.php
@@ -3,9 +3,67 @@
 namespace App\Providers;
 
 // use Illuminate\Support\Facades\Gate;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\ApplicationSetting;
+use App\Models\CloudInitScript;
+use App\Models\CloudProviderToken;
+use App\Models\DiscordNotificationSettings;
+use App\Models\EmailNotificationSettings;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\GithubApp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\PushoverNotificationSettings;
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\SlackNotificationSettings;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Models\SwarmDocker;
+use App\Models\Team;
+use App\Models\TelegramNotificationSettings;
+use App\Models\WebhookNotificationSettings;
+use App\Policies\ApiTokenPolicy;
+use App\Policies\ApplicationPolicy;
+use App\Policies\ApplicationPreviewPolicy;
+use App\Policies\ApplicationSettingPolicy;
+use App\Policies\CloudInitScriptPolicy;
+use App\Policies\CloudProviderTokenPolicy;
+use App\Policies\DatabasePolicy;
+use App\Policies\EnvironmentPolicy;
+use App\Policies\EnvironmentVariablePolicy;
+use App\Policies\GithubAppPolicy;
+use App\Policies\InstanceSettingsPolicy;
+use App\Policies\NotificationPolicy;
+use App\Policies\PrivateKeyPolicy;
+use App\Policies\ProjectPolicy;
 use App\Policies\ResourceCreatePolicy;
+use App\Policies\S3StoragePolicy;
+use App\Policies\ServerPolicy;
+use App\Policies\ServiceApplicationPolicy;
+use App\Policies\ServiceDatabasePolicy;
+use App\Policies\ServicePolicy;
+use App\Policies\SharedEnvironmentVariablePolicy;
+use App\Policies\StandaloneDockerPolicy;
+use App\Policies\SwarmDockerPolicy;
+use App\Policies\TeamPolicy;
 use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
 use Illuminate\Support\Facades\Gate;
+use Laravel\Sanctum\PersonalAccessToken;
 
 class AuthServiceProvider extends ServiceProvider
 {
@@ -15,49 +73,54 @@ class AuthServiceProvider extends ServiceProvider
      * @var array<class-string, class-string>
      */
     protected $policies = [
-        \App\Models\Server::class => \App\Policies\ServerPolicy::class,
-        \App\Models\PrivateKey::class => \App\Policies\PrivateKeyPolicy::class,
-        \App\Models\StandaloneDocker::class => \App\Policies\StandaloneDockerPolicy::class,
-        \App\Models\SwarmDocker::class => \App\Policies\SwarmDockerPolicy::class,
-        \App\Models\Application::class => \App\Policies\ApplicationPolicy::class,
-        \App\Models\ApplicationPreview::class => \App\Policies\ApplicationPreviewPolicy::class,
-        \App\Models\ApplicationSetting::class => \App\Policies\ApplicationSettingPolicy::class,
-        \App\Models\Service::class => \App\Policies\ServicePolicy::class,
-        \App\Models\ServiceApplication::class => \App\Policies\ServiceApplicationPolicy::class,
-        \App\Models\ServiceDatabase::class => \App\Policies\ServiceDatabasePolicy::class,
-        \App\Models\Project::class => \App\Policies\ProjectPolicy::class,
-        \App\Models\Environment::class => \App\Policies\EnvironmentPolicy::class,
-        \App\Models\EnvironmentVariable::class => \App\Policies\EnvironmentVariablePolicy::class,
-        \App\Models\SharedEnvironmentVariable::class => \App\Policies\SharedEnvironmentVariablePolicy::class,
+        Server::class => ServerPolicy::class,
+        PrivateKey::class => PrivateKeyPolicy::class,
+        StandaloneDocker::class => StandaloneDockerPolicy::class,
+        SwarmDocker::class => SwarmDockerPolicy::class,
+        Application::class => ApplicationPolicy::class,
+        ApplicationPreview::class => ApplicationPreviewPolicy::class,
+        ApplicationSetting::class => ApplicationSettingPolicy::class,
+        Service::class => ServicePolicy::class,
+        ServiceApplication::class => ServiceApplicationPolicy::class,
+        ServiceDatabase::class => ServiceDatabasePolicy::class,
+        Project::class => ProjectPolicy::class,
+        Environment::class => EnvironmentPolicy::class,
+        EnvironmentVariable::class => EnvironmentVariablePolicy::class,
+        SharedEnvironmentVariable::class => SharedEnvironmentVariablePolicy::class,
         // Database policies - all use the shared DatabasePolicy
-        \App\Models\StandalonePostgresql::class => \App\Policies\DatabasePolicy::class,
-        \App\Models\StandaloneMysql::class => \App\Policies\DatabasePolicy::class,
-        \App\Models\StandaloneMariadb::class => \App\Policies\DatabasePolicy::class,
-        \App\Models\StandaloneMongodb::class => \App\Policies\DatabasePolicy::class,
-        \App\Models\StandaloneRedis::class => \App\Policies\DatabasePolicy::class,
-        \App\Models\StandaloneKeydb::class => \App\Policies\DatabasePolicy::class,
-        \App\Models\StandaloneDragonfly::class => \App\Policies\DatabasePolicy::class,
-        \App\Models\StandaloneClickhouse::class => \App\Policies\DatabasePolicy::class,
+        StandalonePostgresql::class => DatabasePolicy::class,
+        StandaloneMysql::class => DatabasePolicy::class,
+        StandaloneMariadb::class => DatabasePolicy::class,
+        StandaloneMongodb::class => DatabasePolicy::class,
+        StandaloneRedis::class => DatabasePolicy::class,
+        StandaloneKeydb::class => DatabasePolicy::class,
+        StandaloneDragonfly::class => DatabasePolicy::class,
+        StandaloneClickhouse::class => DatabasePolicy::class,
 
         // Notification policies - all use the shared NotificationPolicy
-        \App\Models\EmailNotificationSettings::class => \App\Policies\NotificationPolicy::class,
-        \App\Models\DiscordNotificationSettings::class => \App\Policies\NotificationPolicy::class,
-        \App\Models\TelegramNotificationSettings::class => \App\Policies\NotificationPolicy::class,
-        \App\Models\SlackNotificationSettings::class => \App\Policies\NotificationPolicy::class,
-        \App\Models\PushoverNotificationSettings::class => \App\Policies\NotificationPolicy::class,
-        \App\Models\WebhookNotificationSettings::class => \App\Policies\NotificationPolicy::class,
+        EmailNotificationSettings::class => NotificationPolicy::class,
+        DiscordNotificationSettings::class => NotificationPolicy::class,
+        TelegramNotificationSettings::class => NotificationPolicy::class,
+        SlackNotificationSettings::class => NotificationPolicy::class,
+        PushoverNotificationSettings::class => NotificationPolicy::class,
+        WebhookNotificationSettings::class => NotificationPolicy::class,
 
         // API Token policy
-        \Laravel\Sanctum\PersonalAccessToken::class => \App\Policies\ApiTokenPolicy::class,
+        PersonalAccessToken::class => ApiTokenPolicy::class,
 
         // Instance settings policy
-        \App\Models\InstanceSettings::class => \App\Policies\InstanceSettingsPolicy::class,
+        InstanceSettings::class => InstanceSettingsPolicy::class,
+
+        // S3 storage policy
+        S3Storage::class => S3StoragePolicy::class,
 
         // Team policy
-        \App\Models\Team::class => \App\Policies\TeamPolicy::class,
+        Team::class => TeamPolicy::class,
 
         // Git source policies
-        \App\Models\GithubApp::class => \App\Policies\GithubAppPolicy::class,
+        GithubApp::class => GithubAppPolicy::class,
+        CloudProviderToken::class => CloudProviderTokenPolicy::class,
+        CloudInitScript::class => CloudInitScriptPolicy::class,
 
     ];
 
diff --git a/app/Traits/HasDatabaseStatusInfo.php b/app/Traits/HasDatabaseStatusInfo.php
index e46cccf0c..5127e0595 100644
--- a/app/Traits/HasDatabaseStatusInfo.php
+++ b/app/Traits/HasDatabaseStatusInfo.php
@@ -30,6 +30,8 @@ trait HasDatabaseStatusInfo
 
     public ?Carbon $certificateValidUntil = null;
 
+    public bool $isPasswordHiddenForMember = false;
+
     abstract protected function databaseLabel(): string;
 
     protected function supportsSsl(): bool
@@ -73,14 +75,20 @@ trait HasDatabaseStatusInfo
 
     public function mount(): void
     {
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
         $this->refresh();
     }
 
     public function refresh(): void
     {
         $this->database->refresh();
-        $this->dbUrl = $this->database->internal_db_url;
-        $this->dbUrlPublic = $this->database->external_db_url;
+        if ($this->isPasswordHiddenForMember) {
+            $this->dbUrl = null;
+            $this->dbUrlPublic = null;
+        } else {
+            $this->dbUrl = $this->database->internal_db_url;
+            $this->dbUrlPublic = $this->database->external_db_url;
+        }
         if ($this->supportsSsl()) {
             $this->enableSsl = (bool) $this->database->enable_ssl;
             $this->certificateValidUntil = $this->database->sslCertificates()->first()?->valid_until;
@@ -167,6 +175,7 @@ trait HasDatabaseStatusInfo
             'sslModeHelper' => $this->sslModeHelper(),
             'showPublicUrlPlaceholder' => $this->showPublicUrlPlaceholder(),
             'isExited' => str($this->database->status)->contains('exited'),
+            'isPasswordHiddenForMember' => $this->isPasswordHiddenForMember,
         ]);
     }
 }
diff --git a/app/View/Components/Forms/Button.php b/app/View/Components/Forms/Button.php
index b54444261..8511c87db 100644
--- a/app/View/Components/Forms/Button.php
+++ b/app/View/Components/Forms/Button.php
@@ -14,6 +14,7 @@ class Button extends Component
      */
     public function __construct(
         public bool $disabled = false,
+        public bool $authDisabled = false,
         public bool $noStyle = false,
         public ?string $modalId = null,
         public string $defaultClass = 'button',
@@ -28,6 +29,7 @@ class Button extends Component
 
             if (! $hasPermission) {
                 $this->disabled = true;
+                $this->authDisabled = true;
             }
         }
 
diff --git a/app/View/Components/Forms/Checkbox.php b/app/View/Components/Forms/Checkbox.php
index eb38d84af..e33e4b919 100644
--- a/app/View/Components/Forms/Checkbox.php
+++ b/app/View/Components/Forms/Checkbox.php
@@ -6,7 +6,6 @@ use Closure;
 use Illuminate\Contracts\View\View;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\View\Component;
-use Visus\Cuid2\Cuid2;
 
 class Checkbox extends Component
 {
@@ -58,7 +57,7 @@ class Checkbox extends Component
         // Generate unique HTML ID by adding random suffix
         // This prevents duplicate IDs when multiple forms are on the same page
         if ($this->id) {
-            $uniqueSuffix = new Cuid2;
+            $uniqueSuffix = new_public_id();
             $this->htmlId = $this->id.'-'.$uniqueSuffix;
         } else {
             $this->htmlId = $this->id;
diff --git a/app/View/Components/Forms/Datalist.php b/app/View/Components/Forms/Datalist.php
index 3b7a9ee34..b0f85c8cb 100644
--- a/app/View/Components/Forms/Datalist.php
+++ b/app/View/Components/Forms/Datalist.php
@@ -6,7 +6,6 @@ use Closure;
 use Illuminate\Contracts\View\View;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\View\Component;
-use Visus\Cuid2\Cuid2;
 
 class Datalist extends Component
 {
@@ -55,7 +54,7 @@ class Datalist extends Component
         $this->modelBinding = $this->id;
 
         if (is_null($this->id)) {
-            $this->id = new Cuid2;
+            $this->id = new_public_id();
             // Don't create wire:model binding for auto-generated IDs
             $this->modelBinding = 'null';
         }
@@ -64,7 +63,7 @@ class Datalist extends Component
         // This prevents duplicate IDs when multiple forms are on the same page
         if ($this->modelBinding && $this->modelBinding !== 'null') {
             // Use original ID with random suffix for uniqueness
-            $uniqueSuffix = new Cuid2;
+            $uniqueSuffix = new_public_id();
             $this->htmlId = $this->modelBinding.'-'.$uniqueSuffix;
         } else {
             $this->htmlId = (string) $this->id;
diff --git a/app/View/Components/Forms/EnvVarInput.php b/app/View/Components/Forms/EnvVarInput.php
index faef64a36..2f26e44cc 100644
--- a/app/View/Components/Forms/EnvVarInput.php
+++ b/app/View/Components/Forms/EnvVarInput.php
@@ -6,7 +6,6 @@ use Closure;
 use Illuminate\Contracts\View\View;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\View\Component;
-use Visus\Cuid2\Cuid2;
 
 class EnvVarInput extends Component
 {
@@ -56,7 +55,7 @@ class EnvVarInput extends Component
         $this->modelBinding = $this->id;
 
         if (is_null($this->id)) {
-            $this->id = new Cuid2;
+            $this->id = new_public_id();
             // Don't create wire:model binding for auto-generated IDs
             $this->modelBinding = 'null';
         }
@@ -64,7 +63,7 @@ class EnvVarInput extends Component
         // This prevents duplicate IDs when multiple forms are on the same page
         if ($this->modelBinding && $this->modelBinding !== 'null') {
             // Use original ID with random suffix for uniqueness
-            $uniqueSuffix = new Cuid2;
+            $uniqueSuffix = new_public_id();
             $this->htmlId = $this->modelBinding.'-'.$uniqueSuffix;
         } else {
             $this->htmlId = (string) $this->id;
diff --git a/app/View/Components/Forms/Input.php b/app/View/Components/Forms/Input.php
index 5ed347f42..303856926 100644
--- a/app/View/Components/Forms/Input.php
+++ b/app/View/Components/Forms/Input.php
@@ -5,8 +5,8 @@ namespace App\View\Components\Forms;
 use Closure;
 use Illuminate\Contracts\View\View;
 use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Str;
 use Illuminate\View\Component;
-use Visus\Cuid2\Cuid2;
 
 class Input extends Component
 {
@@ -51,7 +51,7 @@ class Input extends Component
         $this->modelBinding = $this->id;
 
         if (is_null($this->id)) {
-            $this->id = new Cuid2;
+            $this->id = new_public_id();
             // Don't create wire:model binding for auto-generated IDs
             $this->modelBinding = 'null';
         }
@@ -59,7 +59,7 @@ class Input extends Component
         // This prevents duplicate IDs when multiple forms are on the same page
         if ($this->modelBinding && $this->modelBinding !== 'null') {
             // Use original ID with random suffix for uniqueness
-            $uniqueSuffix = new Cuid2;
+            $uniqueSuffix = new_public_id();
             $this->htmlId = $this->modelBinding.'-'.$uniqueSuffix;
         } else {
             $this->htmlId = (string) $this->id;
diff --git a/app/View/Components/Forms/Select.php b/app/View/Components/Forms/Select.php
index 026e3ba8c..327c33da6 100644
--- a/app/View/Components/Forms/Select.php
+++ b/app/View/Components/Forms/Select.php
@@ -6,7 +6,6 @@ use Closure;
 use Illuminate\Contracts\View\View;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\View\Component;
-use Visus\Cuid2\Cuid2;
 
 class Select extends Component
 {
@@ -48,7 +47,7 @@ class Select extends Component
         $this->modelBinding = $this->id;
 
         if (is_null($this->id)) {
-            $this->id = new Cuid2;
+            $this->id = new_public_id();
             // Don't create wire:model binding for auto-generated IDs
             $this->modelBinding = 'null';
         }
@@ -57,7 +56,7 @@ class Select extends Component
         // This prevents duplicate IDs when multiple forms are on the same page
         if ($this->modelBinding && $this->modelBinding !== 'null') {
             // Use original ID with random suffix for uniqueness
-            $uniqueSuffix = new Cuid2;
+            $uniqueSuffix = new_public_id();
             $this->htmlId = $this->modelBinding.'-'.$uniqueSuffix;
         } else {
             $this->htmlId = (string) $this->id;
diff --git a/app/View/Components/Forms/Textarea.php b/app/View/Components/Forms/Textarea.php
index 02a23a26a..5a5f975c6 100644
--- a/app/View/Components/Forms/Textarea.php
+++ b/app/View/Components/Forms/Textarea.php
@@ -5,8 +5,8 @@ namespace App\View\Components\Forms;
 use Closure;
 use Illuminate\Contracts\View\View;
 use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Str;
 use Illuminate\View\Component;
-use Visus\Cuid2\Cuid2;
 
 class Textarea extends Component
 {
@@ -63,7 +63,7 @@ class Textarea extends Component
         $this->modelBinding = $this->id;
 
         if (is_null($this->id)) {
-            $this->id = new Cuid2;
+            $this->id = new_public_id();
             // Don't create wire:model binding for auto-generated IDs
             $this->modelBinding = 'null';
         }
@@ -72,7 +72,7 @@ class Textarea extends Component
         // This prevents duplicate IDs when multiple forms are on the same page
         if ($this->modelBinding && $this->modelBinding !== 'null') {
             // Use original ID with random suffix for uniqueness
-            $uniqueSuffix = new Cuid2;
+            $uniqueSuffix = new_public_id();
             $this->htmlId = $this->modelBinding.'-'.$uniqueSuffix;
         } else {
             $this->htmlId = (string) $this->id;
diff --git a/bootstrap/helpers/applications.php b/bootstrap/helpers/applications.php
index 4707b0a07..b7e4af7ab 100644
--- a/bootstrap/helpers/applications.php
+++ b/bootstrap/helpers/applications.php
@@ -10,7 +10,6 @@ use App\Models\EnvironmentVariable;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use Spatie\Url\Url;
-use Visus\Cuid2\Cuid2;
 
 function queue_application_deployment(Application $application, string $deployment_uuid, ?int $pull_request_id = 0, ?string $commit = null, bool $force_rebuild = false, bool $is_webhook = false, bool $is_api = false, bool $restart_only = false, ?string $git_type = null, bool $no_questions_asked = false, ?Server $server = null, ?StandaloneDocker $destination = null, bool $only_this_server = false, bool $rollback = false, ?string $docker_registry_image_tag = null)
 {
@@ -192,7 +191,7 @@ function next_after_cancel(?Server $server = null)
 
 function clone_application(Application $source, $destination, array $overrides = [], bool $cloneVolumeData = false): Application
 {
-    $uuid = $overrides['uuid'] ?? (string) new Cuid2;
+    $uuid = $overrides['uuid'] ?? new_public_id();
     $server = $destination->server;
 
     if ($server->team_id !== currentTeam()->id) {
@@ -259,7 +258,7 @@ function clone_application(Application $source, $destination, array $overrides =
             'created_at',
             'updated_at',
         ])->fill([
-            'uuid' => (string) new Cuid2,
+            'uuid' => new_public_id(),
             'application_id' => $newApplication->id,
             'team_id' => currentTeam()->id,
         ]);
@@ -274,7 +273,7 @@ function clone_application(Application $source, $destination, array $overrides =
             'created_at',
             'updated_at',
         ])->fill([
-            'uuid' => (string) new Cuid2,
+            'uuid' => new_public_id(),
             'application_id' => $newApplication->id,
             'status' => 'exited',
             'fqdn' => null,
@@ -322,7 +321,7 @@ function clone_application(Application $source, $destination, array $overrides =
                 VolumeCloneJob::dispatch($sourceVolume, $targetVolume, $sourceServer, $targetServer, $newPersistentVolume);
 
                 queue_application_deployment(
-                    deployment_uuid: (string) new Cuid2,
+                    deployment_uuid: new_public_id(),
                     application: $source,
                     server: $sourceServer,
                     destination: $source->destination,
diff --git a/bootstrap/helpers/databases.php b/bootstrap/helpers/databases.php
index 4d5e085f3..5f0b2e690 100644
--- a/bootstrap/helpers/databases.php
+++ b/bootstrap/helpers/databases.php
@@ -17,12 +17,11 @@ use App\Models\SwarmDocker;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
-use Visus\Cuid2\Cuid2;
 
 function create_standalone_postgresql($environmentId, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null, string $databaseImage = 'postgres:16-alpine'): StandalonePostgresql
 {
     $database = new StandalonePostgresql;
-    $database->uuid = (new Cuid2);
+    $database->uuid = new_public_id();
     $database->name = 'postgresql-database-'.$database->uuid;
     $database->image = $databaseImage;
     $database->postgres_password = Str::password(length: 64, symbols: false);
@@ -40,7 +39,7 @@ function create_standalone_postgresql($environmentId, StandaloneDocker|SwarmDock
 function create_standalone_redis($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneRedis
 {
     $database = new StandaloneRedis;
-    $database->uuid = (new Cuid2);
+    $database->uuid = new_public_id();
     $database->name = 'redis-database-'.$database->uuid;
 
     $redis_password = Str::password(length: 64, symbols: false);
@@ -79,7 +78,7 @@ function create_standalone_redis($environment_id, StandaloneDocker|SwarmDocker $
 function create_standalone_mongodb($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneMongodb
 {
     $database = new StandaloneMongodb;
-    $database->uuid = (new Cuid2);
+    $database->uuid = new_public_id();
     $database->name = 'mongodb-database-'.$database->uuid;
     $database->mongo_initdb_root_password = Str::password(length: 64, symbols: false);
     $database->environment_id = $environment_id;
@@ -96,7 +95,7 @@ function create_standalone_mongodb($environment_id, StandaloneDocker|SwarmDocker
 function create_standalone_mysql($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneMysql
 {
     $database = new StandaloneMysql;
-    $database->uuid = (new Cuid2);
+    $database->uuid = new_public_id();
     $database->name = 'mysql-database-'.$database->uuid;
     $database->mysql_root_password = Str::password(length: 64, symbols: false);
     $database->mysql_password = Str::password(length: 64, symbols: false);
@@ -114,7 +113,7 @@ function create_standalone_mysql($environment_id, StandaloneDocker|SwarmDocker $
 function create_standalone_mariadb($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneMariadb
 {
     $database = new StandaloneMariadb;
-    $database->uuid = (new Cuid2);
+    $database->uuid = new_public_id();
     $database->name = 'mariadb-database-'.$database->uuid;
     $database->mariadb_root_password = Str::password(length: 64, symbols: false);
     $database->mariadb_password = Str::password(length: 64, symbols: false);
@@ -132,7 +131,7 @@ function create_standalone_mariadb($environment_id, StandaloneDocker|SwarmDocker
 function create_standalone_keydb($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneKeydb
 {
     $database = new StandaloneKeydb;
-    $database->uuid = (new Cuid2);
+    $database->uuid = new_public_id();
     $database->name = 'keydb-database-'.$database->uuid;
     $database->keydb_password = Str::password(length: 64, symbols: false);
     $database->environment_id = $environment_id;
@@ -149,7 +148,7 @@ function create_standalone_keydb($environment_id, StandaloneDocker|SwarmDocker $
 function create_standalone_dragonfly($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneDragonfly
 {
     $database = new StandaloneDragonfly;
-    $database->uuid = (new Cuid2);
+    $database->uuid = new_public_id();
     $database->name = 'dragonfly-database-'.$database->uuid;
     $database->dragonfly_password = Str::password(length: 64, symbols: false);
     $database->environment_id = $environment_id;
@@ -166,7 +165,7 @@ function create_standalone_dragonfly($environment_id, StandaloneDocker|SwarmDock
 function create_standalone_clickhouse($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneClickhouse
 {
     $database = new StandaloneClickhouse;
-    $database->uuid = (new Cuid2);
+    $database->uuid = new_public_id();
     $database->name = 'clickhouse-database-'.$database->uuid;
     $database->clickhouse_admin_password = Str::password(length: 64, symbols: false);
     $database->environment_id = $environment_id;
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index 2cf159bfd..1b389c77c 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -9,7 +9,6 @@ use Illuminate\Support\Collection;
 use Illuminate\Support\Str;
 use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
-use Visus\Cuid2\Cuid2;
 
 function getCurrentApplicationContainerStatus(Server $server, int $id, ?int $pullRequestId = null, ?bool $includePullrequests = false): Collection
 {
@@ -459,7 +458,7 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
     foreach ($domains as $loop => $domain) {
         try {
             if ($generate_unique_uuid) {
-                $uuid = new Cuid2;
+                $uuid = new_public_id();
             }
 
             $url = Url::fromString($domain);
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index 123cf906a..6632e1fd5 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -14,7 +14,6 @@ use Illuminate\Support\Facades\File;
 use Illuminate\Support\Str;
 use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
-use Visus\Cuid2\Cuid2;
 
 /**
  * Validates a Docker Compose YAML string for command injection vulnerabilities.
@@ -1240,7 +1239,7 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                         $schema = $url->getScheme();
                         $portInt = $url->getPort();
                         $port = $portInt !== null ? ':'.$portInt : '';
-                        $random = new Cuid2;
+                        $random = new_public_id();
                         $preview_fqdn = str_replace('{{random}}', $random, $template);
                         $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
                         $preview_fqdn = str_replace('{{pr_id}}', $pullRequestId, $preview_fqdn);
diff --git a/bootstrap/helpers/remoteProcess.php b/bootstrap/helpers/remoteProcess.php
index 3a516378f..0f3a7c4dd 100644
--- a/bootstrap/helpers/remoteProcess.php
+++ b/bootstrap/helpers/remoteProcess.php
@@ -202,6 +202,11 @@ function decode_remote_command_output(?ApplicationDeploymentQueue $application_d
     $is_debug_enabled = data_get($application, 'settings.is_debug_enabled');
     $serverTimezone = getServerTimezone(data_get($application, 'destination.server'));
 
+    // Members should never see debug logs, even if an admin enabled debug mode
+    if ($is_debug_enabled && auth()->check() && auth()->user()->isMember()) {
+        $is_debug_enabled = false;
+    }
+
     $logs = data_get($application_deployment_queue, 'logs');
     if (empty($logs)) {
         return collect([]);
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 8fdfceaf1..7b113e7b8 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -64,7 +64,6 @@ use PurplePixie\PhpDns\DNSQuery;
 use PurplePixie\PhpDns\DNSTypes;
 use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
-use Visus\Cuid2\Cuid2;
 
 function base_configuration_dir(): string
 {
@@ -115,6 +114,13 @@ function sanitize_string(?string $input = null): ?string
     return $sanitized;
 }
 
+function new_public_id(int $length = 24): string
+{
+    $length = max(1, $length);
+
+    return Str::lower(Str::random($length));
+}
+
 /**
  * Validate that a path or identifier is safe for use in shell commands.
  *
@@ -455,7 +461,7 @@ function generate_random_name(?string $cuid = null): string
         ]
     );
     if (is_null($cuid)) {
-        $cuid = new Cuid2;
+        $cuid = new_public_id();
     }
 
     return Str::kebab("{$generator->getName()}-$cuid");
@@ -491,7 +497,7 @@ function formatPrivateKey(string $privateKey)
 function generate_application_name(string $git_repository, string $git_branch, ?string $cuid = null): string
 {
     if (is_null($cuid)) {
-        $cuid = new Cuid2;
+        $cuid = new_public_id();
     }
 
     $repo_name = str_contains($git_repository, '/') ? last(explode('/', $git_repository)) : $git_repository;
@@ -3259,7 +3265,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     $template = $resource->preview_url_template;
                                     $host = $url->getHost();
                                     $schema = $url->getScheme();
-                                    $random = new Cuid2;
+                                    $random = new_public_id();
                                     $preview_fqdn = str_replace('{{random}}', $random, $template);
                                     $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
                                     $preview_fqdn = str_replace('{{pr_id}}', $pull_request_id, $preview_fqdn);
diff --git a/database/factories/CloudProviderTokenFactory.php b/database/factories/CloudProviderTokenFactory.php
index 303f08fc8..4da7a2d08 100644
--- a/database/factories/CloudProviderTokenFactory.php
+++ b/database/factories/CloudProviderTokenFactory.php
@@ -13,18 +13,13 @@ class CloudProviderTokenFactory extends Factory
 {
     protected $model = CloudProviderToken::class;
 
-    /**
-     * Define the model's default state.
-     *
-     * @return array<string, mixed>
-     */
     public function definition(): array
     {
         return [
             'team_id' => Team::factory(),
             'provider' => 'hetzner',
-            'token' => $this->faker->sha256(),
-            'name' => $this->faker->words(2, true),
+            'token' => 'test-cloud-provider-token',
+            'name' => fake()->words(3, true),
         ];
     }
 }
diff --git a/database/factories/PrivateKeyFactory.php b/database/factories/PrivateKeyFactory.php
new file mode 100644
index 000000000..51cfdcaa2
--- /dev/null
+++ b/database/factories/PrivateKeyFactory.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\PrivateKey;
+use App\Models\Team;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+/**
+ * @extends Factory<PrivateKey>
+ */
+class PrivateKeyFactory extends Factory
+{
+    protected $model = PrivateKey::class;
+
+    public function definition(): array
+    {
+        return [
+            'name' => fake()->words(2, true),
+            'description' => fake()->sentence(),
+            'private_key' => $this->privateKey(),
+            'team_id' => Team::factory(),
+            'is_git_related' => false,
+        ];
+    }
+
+    private function privateKey(): string
+    {
+        return '-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi/QySHv0Mk
+hwAAAAtzc2gtZWQyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevA
+AAAECBQw4jg1WRT2IGHMncCiZhURCts2s24HoDS0thHnnRKVuGmoeGq/pojrsyP1pszcNV
+uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
+-----END OPENSSH PRIVATE KEY-----';
+    }
+}
diff --git a/database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php b/database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php
index 63bd39f6c..19c4445b2 100644
--- a/database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php
+++ b/database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php
@@ -11,7 +11,7 @@ return new class extends Migration
      */
     public function up(): void
     {
-        // SQLite (testing) uses type affinity, so json columns already accept text
+        // SQLite (testing) uses type affinity, so json columns already accept text.
         if (DB::connection()->getDriverName() !== 'pgsql') {
             return;
         }
diff --git a/resources/css/utilities.css b/resources/css/utilities.css
index 170e6ac16..c982f9f86 100644
--- a/resources/css/utilities.css
+++ b/resources/css/utilities.css
@@ -122,7 +122,11 @@
 }
 
 @utility button {
-    @apply flex gap-2 justify-center items-center px-2 h-8 text-sm text-black normal-case rounded-sm border-2 outline-0 cursor-pointer font-medium bg-white border-neutral-200 hover:bg-neutral-100 dark:bg-coolgray-100 dark:text-white dark:hover:text-white dark:hover:bg-coolgray-200 dark:border-coolgray-300 hover:text-black disabled:cursor-not-allowed min-w-fit dark:disabled:text-neutral-600 disabled:border-transparent disabled:hover:bg-transparent disabled:bg-transparent disabled:text-neutral-300 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs dark:focus-visible:ring-warning focus-visible:ring-offset-2 dark:focus-visible:ring-offset-base;
+    @apply flex gap-2 justify-center items-center px-2 h-8 text-sm text-black normal-case rounded-sm border-2 outline-0 cursor-pointer font-medium bg-white border-neutral-200 hover:bg-neutral-100 dark:bg-coolgray-100 dark:text-white dark:hover:text-white dark:hover:bg-coolgray-200 dark:border-coolgray-300 hover:text-black disabled:cursor-not-allowed min-w-fit dark:disabled:text-neutral-600 disabled:border-neutral-200 dark:disabled:border-coolgray-300 disabled:hover:bg-transparent disabled:bg-transparent disabled:text-neutral-300 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs dark:focus-visible:ring-warning focus-visible:ring-offset-2 dark:focus-visible:ring-offset-base;
+}
+
+@utility auth-tooltip {
+    @apply fixed z-[99] px-2.5 py-1.5 text-xs rounded-sm pointer-events-none whitespace-nowrap text-neutral-700 bg-neutral-200 dark:text-neutral-300 dark:bg-coolgray-400;
 }
 
 @utility alert-success {
@@ -355,4 +359,8 @@
         gap: 0;
         margin-inline: auto;
     }
+
+    .sidebar-collapsed .sidebar-collapsed-label {
+        display: none;
+    }
 }
diff --git a/resources/views/components/applications/advanced.blade.php b/resources/views/components/applications/advanced.blade.php
index d97140570..780a727e1 100644
--- a/resources/views/components/applications/advanced.blade.php
+++ b/resources/views/components/applications/advanced.blade.php
@@ -3,50 +3,84 @@
         Advanced
     </x-slot>
     @if ($application->status === 'running')
-        <x-modal-confirmation title="Confirm Application Force Deployment?" buttonTitle="Force deploy"
-            submitAction="force_deploy_without_cache" :actions="[
-                'This application will be force deployed without build cache.',
-            ]" :confirmWithText="false" :confirmWithPassword="false"
-            step2ButtonText="Confirm">
-            <x-slot:content>
-                <div class="dropdown-iteme">
-                    <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" stroke-width="1.5"
-                        stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
-                        <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                        <path
-                            d="M12.983 8.978c3.955 -.182 7.017 -1.446 7.017 -2.978c0 -1.657 -3.582 -3 -8 -3c-1.661 0 -3.204 .19 -4.483 .515m-2.783 1.228c-.471 .382 -.734 .808 -.734 1.257c0 1.22 1.944 2.271 4.734 2.74" />
-                        <path
-                            d="M4 6v6c0 1.657 3.582 3 8 3c.986 0 1.93 -.067 2.802 -.19m3.187 -.82c1.251 -.53 2.011 -1.228 2.011 -1.99v-6" />
-                        <path d="M4 12v6c0 1.657 3.582 3 8 3c3.217 0 5.991 -.712 7.261 -1.74m.739 -3.26v-4" />
-                        <path d="M3 3l18 18" />
-                    </svg>
-                    Force deploy (without
-                    cache)
-                </div>
-            </x-slot:content>
-        </x-modal-confirmation>
+        @can('deploy', $application)
+            <x-modal-confirmation title="Confirm Application Force Deployment?" buttonTitle="Force deploy"
+                submitAction="force_deploy_without_cache" :actions="[
+                    'This application will be force deployed without build cache.',
+                ]" :confirmWithText="false" :confirmWithPassword="false"
+                step2ButtonText="Confirm">
+                <x-slot:content>
+                    <div class="dropdown-iteme">
+                        <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" stroke-width="1.5"
+                            stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
+                            <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                            <path
+                                d="M12.983 8.978c3.955 -.182 7.017 -1.446 7.017 -2.978c0 -1.657 -3.582 -3 -8 -3c-1.661 0 -3.204 .19 -4.483 .515m-2.783 1.228c-.471 .382 -.734 .808 -.734 1.257c0 1.22 1.944 2.271 4.734 2.74" />
+                            <path
+                                d="M4 6v6c0 1.657 3.582 3 8 3c.986 0 1.93 -.067 2.802 -.19m3.187 -.82c1.251 -.53 2.011 -1.228 2.011 -1.99v-6" />
+                            <path d="M4 12v6c0 1.657 3.582 3 8 3c3.217 0 5.991 -.712 7.261 -1.74m.739 -3.26v-4" />
+                            <path d="M3 3l18 18" />
+                        </svg>
+                        Force deploy (without
+                        cache)
+                    </div>
+                </x-slot:content>
+            </x-modal-confirmation>
+        @else
+            <div class="dropdown-iteme" data-disabled>
+                <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" stroke-width="1.5"
+                    stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
+                    <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                    <path
+                        d="M12.983 8.978c3.955 -.182 7.017 -1.446 7.017 -2.978c0 -1.657 -3.582 -3 -8 -3c-1.661 0 -3.204 .19 -4.483 .515m-2.783 1.228c-.471 .382 -.734 .808 -.734 1.257c0 1.22 1.944 2.271 4.734 2.74" />
+                    <path
+                        d="M4 6v6c0 1.657 3.582 3 8 3c.986 0 1.93 -.067 2.802 -.19m3.187 -.82c1.251 -.53 2.011 -1.228 2.011 -1.99v-6" />
+                    <path d="M4 12v6c0 1.657 3.582 3 8 3c3.217 0 5.991 -.712 7.261 -1.74m.739 -3.26v-4" />
+                    <path d="M3 3l18 18" />
+                </svg>
+                Force deploy (without
+                cache)
+            </div>
+        @endcan
     @else
-        <x-modal-confirmation title="Confirm Application Force Deployment?" buttonTitle="Force deploy"
-            submitAction="deploy(true)" :actions="[
-                'This application will be force deployed without build cache.',
-            ]" :confirmWithText="false" :confirmWithPassword="false"
-            step2ButtonText="Confirm">
-            <x-slot:content>
-                <div class="dropdown-item">
-                    <svg xmlns="http://www.w3.org/2000/svg" class="w-4 h-4" viewBox="0 0 24 24" stroke-width="1.5"
-                        stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
-                        <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                        <path
-                            d="M12.983 8.978c3.955 -.182 7.017 -1.446 7.017 -2.978c0 -1.657 -3.582 -3 -8 -3c-1.661 0 -3.204 .19 -4.483 .515m-2.783 1.228c-.471 .382 -.734 .808 -.734 1.257c0 1.22 1.944 2.271 4.734 2.74" />
-                        <path
-                            d="M4 6v6c0 1.657 3.582 3 8 3c.986 0 1.93 -.067 2.802 -.19m3.187 -.82c1.251 -.53 2.011 -1.228 2.011 -1.99v-6" />
-                        <path d="M4 12v6c0 1.657 3.582 3 8 3c3.217 0 5.991 -.712 7.261 -1.74m.739 -3.26v-4" />
-                        <path d="M3 3l18 18" />
-                    </svg>
-                    Force deploy (without
-                    cache)
-                </div>
-            </x-slot:content>
-        </x-modal-confirmation>
+        @can('deploy', $application)
+            <x-modal-confirmation title="Confirm Application Force Deployment?" buttonTitle="Force deploy"
+                submitAction="deploy(true)" :actions="[
+                    'This application will be force deployed without build cache.',
+                ]" :confirmWithText="false" :confirmWithPassword="false"
+                step2ButtonText="Confirm">
+                <x-slot:content>
+                    <div class="dropdown-item">
+                        <svg xmlns="http://www.w3.org/2000/svg" class="w-4 h-4" viewBox="0 0 24 24" stroke-width="1.5"
+                            stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
+                            <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                            <path
+                                d="M12.983 8.978c3.955 -.182 7.017 -1.446 7.017 -2.978c0 -1.657 -3.582 -3 -8 -3c-1.661 0 -3.204 .19 -4.483 .515m-2.783 1.228c-.471 .382 -.734 .808 -.734 1.257c0 1.22 1.944 2.271 4.734 2.74" />
+                            <path
+                                d="M4 6v6c0 1.657 3.582 3 8 3c.986 0 1.93 -.067 2.802 -.19m3.187 -.82c1.251 -.53 2.011 -1.228 2.011 -1.99v-6" />
+                            <path d="M4 12v6c0 1.657 3.582 3 8 3c3.217 0 5.991 -.712 7.261 -1.74m.739 -3.26v-4" />
+                            <path d="M3 3l18 18" />
+                        </svg>
+                        Force deploy (without
+                        cache)
+                    </div>
+                </x-slot:content>
+            </x-modal-confirmation>
+        @else
+            <div class="dropdown-item" data-disabled>
+                <svg xmlns="http://www.w3.org/2000/svg" class="w-4 h-4" viewBox="0 0 24 24" stroke-width="1.5"
+                    stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
+                    <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                    <path
+                        d="M12.983 8.978c3.955 -.182 7.017 -1.446 7.017 -2.978c0 -1.657 -3.582 -3 -8 -3c-1.661 0 -3.204 .19 -4.483 .515m-2.783 1.228c-.471 .382 -.734 .808 -.734 1.257c0 1.22 1.944 2.271 4.734 2.74" />
+                    <path
+                        d="M4 6v6c0 1.657 3.582 3 8 3c.986 0 1.93 -.067 2.802 -.19m3.187 -.82c1.251 -.53 2.011 -1.228 2.011 -1.99v-6" />
+                    <path d="M4 12v6c0 1.657 3.582 3 8 3c3.217 0 5.991 -.712 7.261 -1.74m.739 -3.26v-4" />
+                    <path d="M3 3l18 18" />
+                </svg>
+                Force deploy (without
+                cache)
+            </div>
+        @endcan
     @endif
 </x-dropdown>
diff --git a/resources/views/components/database-status-info.blade.php b/resources/views/components/database-status-info.blade.php
index 4a9de3ca5..24116db25 100644
--- a/resources/views/components/database-status-info.blade.php
+++ b/resources/views/components/database-status-info.blade.php
@@ -11,6 +11,7 @@
     'certificateValidUntil' => null,
     'isExited' => false,
     'showPublicUrlPlaceholder' => false,
+    'isPasswordHiddenForMember' => false,
 ])
 
 @php
@@ -18,14 +19,19 @@
 @endphp
 
 <div class="flex flex-col gap-2">
-    <x-forms.input :label="$label . ' URL (internal)'" :helper="$urlHelper" type="password" readonly
-        wire:model="dbUrl" canGate="update" :canResource="$database" />
-    @if ($dbUrlPublic)
-        <x-forms.input :label="$label . ' URL (public)'" :helper="$urlHelper" type="password" readonly
-            wire:model="dbUrlPublic" canGate="update" :canResource="$database" />
-    @elseif ($showPublicUrlPlaceholder)
-        <x-forms.input :label="$label . ' URL (public)'" :helper="$urlHelper" readonly
-            value="Starting the database will generate this." canGate="update" :canResource="$database" />
+    @if ($isPasswordHiddenForMember)
+        <x-forms.input :label="$label . ' URL (internal)'" disabled value="Hidden (only admins can view)" />
+        <x-forms.input :label="$label . ' URL (public)'" disabled value="Hidden (only admins can view)" />
+    @else
+        <x-forms.input :label="$label . ' URL (internal)'" :helper="$urlHelper" type="password" readonly
+            wire:model="dbUrl" canGate="update" :canResource="$database" />
+        @if ($dbUrlPublic)
+            <x-forms.input :label="$label . ' URL (public)'" :helper="$urlHelper" type="password" readonly
+                wire:model="dbUrlPublic" canGate="update" :canResource="$database" />
+        @elseif ($showPublicUrlPlaceholder)
+            <x-forms.input :label="$label . ' URL (public)'" :helper="$urlHelper" readonly
+                value="Starting the database will generate this." canGate="update" :canResource="$database" />
+        @endif
     @endif
 
     @if ($supportsSsl)
diff --git a/resources/views/components/forms/button.blade.php b/resources/views/components/forms/button.blade.php
index 96cdb4420..f1efd8c6c 100644
--- a/resources/views/components/forms/button.blade.php
+++ b/resources/views/components/forms/button.blade.php
@@ -1,3 +1,24 @@
+@if ($authDisabled)
+<span class="relative inline-flex"
+    x-data="{ visible: false, _t: null }"
+    @mouseenter="_t = setTimeout(() => {
+        visible = true;
+        $nextTick(() => requestAnimationFrame(() => {
+            const tip = $refs.tip;
+            if (!tip) return;
+            const r = $el.getBoundingClientRect();
+            const t = tip.getBoundingClientRect();
+            let top = r.top - t.height - 6;
+            let left = r.left;
+            if (top < 4) top = r.bottom + 6;
+            if (left + t.width > innerWidth - 8) left = innerWidth - 8 - t.width;
+            if (left < 4) left = 4;
+            tip.style.top = top + 'px';
+            tip.style.left = left + 'px';
+        }));
+    }, 300)"
+    @mouseleave="clearTimeout(_t); visible = false">
+@endif
 <button @disabled($disabled) {{ $attributes->merge(['class' => $defaultClass]) }}
     {{ $attributes->merge(['type' => 'button']) }}
     @isset($confirm)
@@ -18,3 +39,9 @@
         @endif
     @endif
 </button>
+@if ($authDisabled)
+    <div x-ref="tip" x-show="visible" x-cloak class="auth-tooltip">
+        You do not have permission to perform this action.
+    </div>
+</span>
+@endif
diff --git a/resources/views/components/forms/copy-button.blade.php b/resources/views/components/forms/copy-button.blade.php
index eb3f3d8a4..61233b2ca 100644
--- a/resources/views/components/forms/copy-button.blade.php
+++ b/resources/views/components/forms/copy-button.blade.php
@@ -2,24 +2,27 @@
 
 <div class="w-full" x-data="{ copied: false, isSecure: window.isSecureContext }">
     @if ($label)
-        <label class="flex gap-1 items-center mb-1 text-sm font-medium">{{ $label }}</label>
+        <label class="flex gap-1 items-center mb-1 text-sm font-medium text-black dark:text-white">{{ $label }}</label>
     @endif
     <div class="relative">
-        <input type="text" value="{{ $text }}" class="input pr-10"
+        <input type="text" value="{{ $text }}"
+            class="input pr-11 bg-white dark:bg-coolgray-100 dark:read-only:bg-coolgray-100 dark:read-only:text-white"
+            readonly
             @keydown.prevent @paste.prevent @cut.prevent @drop.prevent
             @focus="$event.target.select()">
-    <button
-        x-show="isSecure"
-        @click.prevent="copied = true; navigator.clipboard.writeText({{ Js::from($text) }}); setTimeout(() => copied = false, 1000)"
-        class="absolute right-2 top-1/2 -translate-y-1/2 p-1.5 text-gray-400 hover:text-gray-300 transition-colors"
-        title="Copy to clipboard">
-        <svg x-show="!copied" class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
-                d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
-        </svg>
-        <svg x-show="copied" class="w-5 h-5 text-green-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7" />
-        </svg>
-    </button>
+        <button
+            x-show="isSecure"
+            @click.prevent="copied = true; navigator.clipboard.writeText({{ Js::from($text) }}); setTimeout(() => copied = false, 1000)"
+            class="absolute right-2 top-1/2 -translate-y-1/2 rounded-sm p-1.5 text-neutral-500 transition-colors hover:text-neutral-700 focus-visible:ring-2 focus-visible:ring-coollabs focus-visible:ring-offset-2 dark:text-neutral-400 dark:hover:text-white dark:focus-visible:ring-warning dark:focus-visible:ring-offset-base"
+            title="Copy to clipboard"
+            aria-label="Copy to clipboard">
+            <svg x-show="!copied" class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+                    d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
+            </svg>
+            <svg x-show="copied" class="w-5 h-5 text-green-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7" />
+            </svg>
+        </button>
     </div>
 </div>
diff --git a/resources/views/components/modal-confirmation.blade.php b/resources/views/components/modal-confirmation.blade.php
index b1d7ac475..4629e3b96 100644
--- a/resources/views/components/modal-confirmation.blade.php
+++ b/resources/views/components/modal-confirmation.blade.php
@@ -6,6 +6,7 @@
     'buttonFullWidth' => false,
     'customButton' => null,
     'disabled' => false,
+    'authDisabled' => false,
     'dispatchAction' => false,
     'submitAction' => 'delete',
     'content' => null,
@@ -151,11 +152,11 @@
         @else
             @if ($disabled)
                 @if ($buttonFullWidth)
-                    <x-forms.button class="w-full" isError disabled wire:target>
+                    <x-forms.button class="w-full" isError disabled :authDisabled="$authDisabled" wire:target>
                         {{ $buttonTitle }}
                     </x-forms.button>
                 @else
-                    <x-forms.button isError disabled wire:target>
+                    <x-forms.button isError disabled :authDisabled="$authDisabled" wire:target>
                         {{ $buttonTitle }}
                     </x-forms.button>
                 @endif
diff --git a/resources/views/components/navbar.blade.php b/resources/views/components/navbar.blade.php
index c2ca28a2d..924147e4b 100644
--- a/resources/views/components/navbar.blade.php
+++ b/resources/views/components/navbar.blade.php
@@ -44,16 +44,6 @@
                 this.queryTheme();
                 this.checkZoom();
             },
-            setTheme(type) {
-                this.theme = type;
-                localStorage.setItem('theme', type);
-                this.queryTheme();
-            },
-            cycleTheme() {
-                const themes = ['light', 'system', 'dark'];
-                const currentIndex = themes.indexOf(this.theme || localStorage.getItem('theme') || 'dark');
-                this.setTheme(themes[(currentIndex + 1) % themes.length]);
-            },
             queryTheme() {
                 const darkModePreference = window.matchMedia('(prefers-color-scheme: dark)').matches;
                 const userSettings = localStorage.getItem('theme') || 'dark';
@@ -375,45 +365,6 @@
                     <li>
                         <livewire:settings-dropdown trigger="changelog-sidebar" />
                     </li>
-                    <li>
-                        <button type="button" @click.stop="cycleTheme()"
-                            :title="`Theme: ${theme === 'system' ? 'System default' : theme}. Click to change.`"
-                            :aria-label="`Theme: ${theme === 'system' ? 'System default' : theme}. Click to change theme.`"
-                            class="menu-item"
-                            :class="collapsed && 'lg:hidden'">
-                            <svg x-show="theme === 'dark'" class="menu-item-icon" fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true">
-                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
-                                    d="M20.354 15.354A9 9 0 018.646 3.646 9.003 9.003 0 0012 21a9.003 9.003 0 008.354-5.646z" />
-                            </svg>
-                            <svg x-show="theme === 'light'" class="menu-item-icon" fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true">
-                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
-                                    d="M12 3v1m0 16v1m9-9h-1M4 12H3m15.364 6.364l-.707-.707M6.343 6.343l-.707-.707m12.728 0l-.707.707M6.343 17.657l-.707.707M16 12a4 4 0 11-8 0 4 4 0 018 0z" />
-                            </svg>
-                            <svg x-show="theme === 'system'" class="menu-item-icon" fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true">
-                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
-                                    d="M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z" />
-                            </svg>
-                            <span class="text-left menu-item-label">Theme</span>
-                        </button>
-                        <button type="button" @click.stop="cycleTheme()"
-                            :title="`Theme: ${theme === 'system' ? 'System default' : theme}. Click to change.`"
-                            :aria-label="`Theme: ${theme === 'system' ? 'System default' : theme}. Click to change theme.`"
-                            class="menu-item hidden"
-                            :class="collapsed && 'lg:flex'">
-                            <svg x-show="theme === 'dark'" class="menu-item-icon" fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true">
-                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
-                                    d="M20.354 15.354A9 9 0 018.646 3.646 9.003 9.003 0 0012 21a9.003 9.003 0 008.354-5.646z" />
-                            </svg>
-                            <svg x-show="theme === 'light'" class="menu-item-icon" fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true">
-                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
-                                    d="M12 3v1m0 16v1m9-9h-1M4 12H3m15.364 6.364l-.707-.707M6.343 6.343l-.707-.707m12.728 0l-.707.707M6.343 17.657l-.707.707M16 12a4 4 0 11-8 0 4 4 0 018 0z" />
-                            </svg>
-                            <svg x-show="theme === 'system'" class="menu-item-icon" fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true">
-                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
-                                    d="M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z" />
-                            </svg>
-                        </button>
-                    </li>
                     @if (isInstanceAdmin() && !isCloud())
                         @persist('upgrade')
                             <li>
diff --git a/resources/views/components/server/sidebar-sentinel.blade.php b/resources/views/components/server/sidebar-sentinel.blade.php
index 8125fe22c..421a1ec9d 100644
--- a/resources/views/components/server/sidebar-sentinel.blade.php
+++ b/resources/views/components/server/sidebar-sentinel.blade.php
@@ -1,10 +1,12 @@
 <div class="sub-menu-wrapper">
-    <a class="{{ request()->routeIs('server.sentinel') ? 'sub-menu-item menu-item-active' : 'sub-menu-item' }}" {{ wireNavigate() }}
-        href="{{ route('server.sentinel', $parameters) }}">
-        <span class="menu-item-label">Configuration</span>
-    </a>
-    <a class="{{ request()->routeIs('server.sentinel.logs') ? 'sub-menu-item menu-item-active' : 'sub-menu-item' }}" {{ wireNavigate() }}
-        href="{{ route('server.sentinel.logs', $parameters) }}">
-        <span class="menu-item-label">Logs</span>
-    </a>
+    @can('viewSentinel', $server)
+        <a class="{{ request()->routeIs('server.sentinel') ? 'sub-menu-item menu-item-active' : 'sub-menu-item' }}" {{ wireNavigate() }}
+            href="{{ route('server.sentinel', $parameters) }}">
+            <span class="menu-item-label">Configuration</span>
+        </a>
+        <a class="{{ request()->routeIs('server.sentinel.logs') ? 'sub-menu-item menu-item-active' : 'sub-menu-item' }}" {{ wireNavigate() }}
+            href="{{ route('server.sentinel.logs', $parameters) }}">
+            <span class="menu-item-label">Logs</span>
+        </a>
+    @endcan
 </div>
diff --git a/resources/views/components/services/advanced.blade.php b/resources/views/components/services/advanced.blade.php
index 831723307..1974bf221 100644
--- a/resources/views/components/services/advanced.blade.php
+++ b/resources/views/components/services/advanced.blade.php
@@ -3,7 +3,7 @@
         Advanced
     </x-slot>
     @if (str($service->status)->contains('running'))
-        <div class="dropdown-item" @click="document.getElementById('service-pullAndRestart-trigger')?.click()">
+        <div class="dropdown-item" @if(!auth()->user()->can('deploy', $service)) data-disabled @endif @click="document.getElementById('service-pullAndRestart-trigger')?.click()">
             <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" stroke-width="1.5"
                 stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round">
                 <path stroke="none" d="M0 0h24v24H0z" fill="none" />
@@ -17,7 +17,7 @@
             Pull Latest Images & Restart
         </div>
     @elseif (str($service->status)->contains('degraded'))
-        <div class="dropdown-item" @click="document.getElementById('service-forceDeploy-trigger')?.click()">
+        <div class="dropdown-item" @if(!auth()->user()->can('deploy', $service)) data-disabled @endif @click="document.getElementById('service-forceDeploy-trigger')?.click()">
             <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor"
                 stroke-linecap="round" stroke-linejoin="round" data-darkreader-inline-stroke=""
                 style="--darkreader-inline-stroke: currentColor;" class="w-6 h-6" stroke-width="2">
@@ -27,7 +27,7 @@
             Force Restart
         </div>
     @else
-        <div class="dropdown-item" @click="document.getElementById('service-forceDeploy-trigger')?.click()">
+        <div class="dropdown-item" @if(!auth()->user()->can('deploy', $service)) data-disabled @endif @click="document.getElementById('service-forceDeploy-trigger')?.click()">
             <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor"
                 stroke-linecap="round" stroke-linejoin="round" data-darkreader-inline-stroke=""
                 style="--darkreader-inline-stroke: currentColor;" class="w-4 h-4" stroke-width="2">
@@ -36,7 +36,7 @@
             </svg>
             Force Deploy
         </div>
-        <div class="dropdown-item" @click="document.getElementById('service-cleanup-trigger')?.click()">
+        <div class="dropdown-item" @if(!auth()->user()->can('stop', $service)) data-disabled @endif @click="document.getElementById('service-cleanup-trigger')?.click()">
             <svg class="w-4 h-4" viewBox="0 0 32 32" xmlns="http://www.w3.org/2000/svg">
                 <path fill="currentColor" d="M26 20h-6v-2h6zm4 8h-6v-2h6zm-2-4h-6v-2h6z" />
                 <path fill="currentColor"
diff --git a/resources/views/livewire/dashboard.blade.php b/resources/views/livewire/dashboard.blade.php
index 26a404b17..19d819613 100644
--- a/resources/views/livewire/dashboard.blade.php
+++ b/resources/views/livewire/dashboard.blade.php
@@ -11,20 +11,23 @@
     <section class="-mt-2">
         <div class="flex items-center gap-2 pb-2">
             <h3>Projects</h3>
-            @if ($projects->count() > 0)
-                <x-modal-input buttonTitle="Add" title="New Project">
-                    <x-slot:content>
-                        <button
-                            class="flex items-center justify-center size-4 text-black dark:text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
-                            <svg class="size-3" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                                stroke-width="2" stroke="currentColor">
-                                <path stroke-linecap="round" stroke-linejoin="round" d="M12 4.5v15m7.5-7.5h-15" />
-                            </svg>
-                        </button>
-                    </x-slot:content>
-                    <livewire:project.add-empty />
-                </x-modal-input>
-            @endif
+@can('create', App\Models\Project::class)
+                @if ($projects->count() > 0)
+                    <x-modal-input buttonTitle="Add" title="New Project">
+                        <x-slot:content>
+                            <button
+                                class="flex items-center justify-center size-4 text-black dark:text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
+                                <svg class="size-3" xmlns="http://www.w3.org/2000/svg" fill="none"
+                                    viewBox="0 0 24 24" stroke-width="2" stroke="currentColor">
+                                    <path stroke-linecap="round" stroke-linejoin="round"
+                                        d="M12 4.5v15m7.5-7.5h-15" />
+                                </svg>
+                            </button>
+                        </x-slot:content>
+                        <livewire:project.add-empty />
+                    </x-modal-input>
+                @endif
+            @endcan
         </div>
         @if ($projects->count() > 0)
             <div class="grid grid-cols-1 gap-4 xl:grid-cols-2">
@@ -64,12 +67,15 @@
         @else
             <div class="flex flex-col gap-1">
                 <div class='font-bold dark:text-warning'>No projects found.</div>
-                <div class="flex items-center gap-1">
-                    <x-modal-input buttonTitle="Add" title="New Project">
-                        <livewire:project.add-empty />
-                    </x-modal-input> your first project or
-                    go to the <a class="underline dark:text-white" href="{{ route('onboarding') }}" {{ wireNavigate() }}>onboarding</a> page.
-                </div>
+                @can('create', App\Models\Project::class)
+                    <div class="flex items-center gap-1">
+                        <x-modal-input buttonTitle="Add" title="New Project">
+                            <livewire:project.add-empty />
+                        </x-modal-input> your first project or
+                        go to the <a class="underline dark:text-white" href="{{ route('onboarding') }}"
+                            {{ wireNavigate() }}>onboarding</a> page.
+                    </div>
+                @endcan
             </div>
         @endif
     </section>
@@ -77,20 +83,23 @@
     <section>
         <div class="flex items-center gap-2 pb-2">
             <h3>Servers</h3>
-            @if ($servers->count() > 0 && $privateKeys->count() > 0)
-                <x-modal-input buttonTitle="Add" title="New Server" :closeOutside="false">
-                    <x-slot:content>
-                        <button
-                            class="flex items-center justify-center size-4 text-black dark:text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
-                            <svg class="size-3" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                                stroke-width="2" stroke="currentColor">
-                                <path stroke-linecap="round" stroke-linejoin="round" d="M12 4.5v15m7.5-7.5h-15" />
-                            </svg>
-                        </button>
-                    </x-slot:content>
-                    <livewire:server.create />
-                </x-modal-input>
-            @endif
+@can('create', App\Models\Server::class)
+                @if ($servers->count() > 0 && $privateKeys->count() > 0)
+                    <x-modal-input buttonTitle="Add" title="New Server" :closeOutside="false">
+                        <x-slot:content>
+                            <button
+                                class="flex items-center justify-center size-4 text-black dark:text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
+                                <svg class="size-3" xmlns="http://www.w3.org/2000/svg" fill="none"
+                                    viewBox="0 0 24 24" stroke-width="2" stroke="currentColor">
+                                    <path stroke-linecap="round" stroke-linejoin="round"
+                                        d="M12 4.5v15m7.5-7.5h-15" />
+                                </svg>
+                            </button>
+                        </x-slot:content>
+                        <livewire:server.create />
+                    </x-modal-input>
+                @endif
+            @endcan
         </div>
         @if ($servers->count() > 0)
             <div class="grid grid-cols-1 gap-4 xl:grid-cols-2">
@@ -127,26 +136,34 @@
             @if ($privateKeys->count() === 0)
                 <div class="flex flex-col gap-1">
                     <div class='font-bold dark:text-warning'>No private keys found.</div>
-                    <div class="flex items-center gap-1">Before you can add your server, first <x-modal-input
-                            buttonTitle="add" title="New Private Key">
-                            <livewire:security.private-key.create from="server" />
-                        </x-modal-input> a private key
-                        or
-                        go to the <a class="underline dark:text-white" href="{{ route('onboarding') }}" {{ wireNavigate() }}>onboarding</a>
-                        page.
-                    </div>
+                    @can('create', App\Models\Server::class)
+                        <div class="flex items-center gap-1">Before you can add your server, first <x-modal-input
+                                buttonTitle="add" title="New Private Key">
+                                <livewire:security.private-key.create from="server" />
+                            </x-modal-input> a private key
+                            or
+                            go to the <a class="underline dark:text-white"
+                                href="{{ route('onboarding') }}"
+                                {{ wireNavigate() }}>onboarding</a>
+                            page.
+                        </div>
+                    @endcan
                 </div>
             @else
                 <div class="flex flex-col gap-1">
                     <div class='font-bold dark:text-warning'>No servers found.</div>
-                    <div class="flex items-center gap-1">
-                        <x-modal-input buttonTitle="Add" title="New Server" :closeOutside="false">
-                            <livewire:server.create />
-                        </x-modal-input> your first server
-                        or
-                        go to the <a class="underline dark:text-white" href="{{ route('onboarding') }}" {{ wireNavigate() }}>onboarding</a>
-                        page.
-                    </div>
+                    @can('create', App\Models\Server::class)
+                        <div class="flex items-center gap-1">
+                            <x-modal-input buttonTitle="Add" title="New Server" :closeOutside="false">
+                                <livewire:server.create />
+                            </x-modal-input> your first server
+                            or
+                            go to the <a class="underline dark:text-white"
+                                href="{{ route('onboarding') }}"
+                                {{ wireNavigate() }}>onboarding</a>
+                            page.
+                        </div>
+                    @endcan
                 </div>
             @endif
         @endif
diff --git a/resources/views/livewire/destination/new/docker.blade.php b/resources/views/livewire/destination/new/docker.blade.php
index 953c4d42e..2be64d289 100644
--- a/resources/views/livewire/destination/new/docker.blade.php
+++ b/resources/views/livewire/destination/new/docker.blade.php
@@ -18,7 +18,7 @@
         </form>
     </div>
 @else
-    <x-callout type="warning" title="Permission Required">
+    <x-callout type="danger" title="Insufficient Permissions">
         You don't have permission to create new destinations. Please contact your team administrator for access.
     </x-callout>
 @endcan
diff --git a/resources/views/livewire/notifications/discord.blade.php b/resources/views/livewire/notifications/discord.blade.php
index 0e5406c78..64e445441 100644
--- a/resources/views/livewire/notifications/discord.blade.php
+++ b/resources/views/livewire/notifications/discord.blade.php
@@ -26,9 +26,15 @@
                 helper="If enabled, a ping (@here) will be sent to the notification when a critical event happens."
                 label="Ping Enabled" />
         </div>
-        <x-forms.input canGate="update" :canResource="$settings" type="password"
-            helper="Create a Discord Server and generate a Webhook URL. <br><a class='inline-block underline dark:text-white' href='https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks' target='_blank'>Webhook Documentation</a>"
-            required id="discordWebhookUrl" label="Webhook" />
+        @can('update', $settings)
+            <x-forms.input type="password"
+                helper="Create a Discord Server and generate a Webhook URL. <br><a class='inline-block underline dark:text-white' href='https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks' target='_blank'>Webhook Documentation</a>"
+                required id="discordWebhookUrl" label="Webhook" />
+        @else
+            <x-forms.input disabled
+                helper="Create a Discord Server and generate a Webhook URL. <br><a class='inline-block underline dark:text-white' href='https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks' target='_blank'>Webhook Documentation</a>"
+                required label="Webhook" value="Hidden (only admins can view)" />
+        @endcan
     </form>
     <h2 class="mt-4">Notification Settings</h2>
     <p class="mb-4">
diff --git a/resources/views/livewire/notifications/pushover.blade.php b/resources/views/livewire/notifications/pushover.blade.php
index 74cd9e8d2..4ea1a159c 100644
--- a/resources/views/livewire/notifications/pushover.blade.php
+++ b/resources/views/livewire/notifications/pushover.blade.php
@@ -24,12 +24,21 @@
             <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSavePushoverEnabled" id="pushoverEnabled" label="Enabled" />
         </div>
         <div class="flex  gap-2">
-            <x-forms.input canGate="update" :canResource="$settings" type="password"
-                helper="Get your User Key in Pushover. You need to be logged in to Pushover to see your user key in the top right corner. <br><a class='inline-block underline dark:text-white' href='https://pushover.net/' target='_blank'>Pushover Dashboard</a>"
-                required id="pushoverUserKey" label="User Key" />
-            <x-forms.input canGate="update" :canResource="$settings" type="password"
-                helper="Generate an API Token/Key in Pushover by creating a new application. <br><a class='inline-block underline dark:text-white' href='https://pushover.net/apps/build' target='_blank'>Create Pushover Application</a>"
-                required id="pushoverApiToken" label="API Token" />
+            @can('update', $settings)
+                <x-forms.input type="password"
+                    helper="Get your User Key in Pushover. You need to be logged in to Pushover to see your user key in the top right corner. <br><a class='inline-block underline dark:text-white' href='https://pushover.net/' target='_blank'>Pushover Dashboard</a>"
+                    required id="pushoverUserKey" label="User Key" />
+                <x-forms.input type="password"
+                    helper="Generate an API Token/Key in Pushover by creating a new application. <br><a class='inline-block underline dark:text-white' href='https://pushover.net/apps/build' target='_blank'>Create Pushover Application</a>"
+                    required id="pushoverApiToken" label="API Token" />
+            @else
+                <x-forms.input disabled
+                    helper="Get your User Key in Pushover. You need to be logged in to Pushover to see your user key in the top right corner. <br><a class='inline-block underline dark:text-white' href='https://pushover.net/' target='_blank'>Pushover Dashboard</a>"
+                    required label="User Key" value="Hidden (only admins can view)" />
+                <x-forms.input disabled
+                    helper="Generate an API Token/Key in Pushover by creating a new application. <br><a class='inline-block underline dark:text-white' href='https://pushover.net/apps/build' target='_blank'>Create Pushover Application</a>"
+                    required label="API Token" value="Hidden (only admins can view)" />
+            @endcan
         </div>
     </form>
     <h2 class="mt-4">Notification Settings</h2>
diff --git a/resources/views/livewire/notifications/slack.blade.php b/resources/views/livewire/notifications/slack.blade.php
index 14c7b3508..9ab752291 100644
--- a/resources/views/livewire/notifications/slack.blade.php
+++ b/resources/views/livewire/notifications/slack.blade.php
@@ -23,9 +23,15 @@
         <div class="w-32">
             <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSaveSlackEnabled" id="slackEnabled" label="Enabled" />
         </div>
-        <x-forms.input canGate="update" :canResource="$settings" type="password"
-            helper="Create a Slack APP and generate a Incoming Webhook URL. <br><a class='inline-block underline dark:text-white' href='https://api.slack.com/apps' target='_blank'>Create Slack APP</a>"
-            required id="slackWebhookUrl" label="Webhook" />
+        @can('update', $settings)
+            <x-forms.input type="password"
+                helper="Create a Slack APP and generate a Incoming Webhook URL. <br><a class='inline-block underline dark:text-white' href='https://api.slack.com/apps' target='_blank'>Create Slack APP</a>"
+                required id="slackWebhookUrl" label="Webhook" />
+        @else
+            <x-forms.input disabled
+                helper="Create a Slack APP and generate a Incoming Webhook URL. <br><a class='inline-block underline dark:text-white' href='https://api.slack.com/apps' target='_blank'>Create Slack APP</a>"
+                required label="Webhook" value="Hidden (only admins can view)" />
+        @endcan
     </form>
     <h2 class="mt-4">Notification Settings</h2>
     <p class="mb-4">
diff --git a/resources/views/livewire/notifications/telegram.blade.php b/resources/views/livewire/notifications/telegram.blade.php
index f87a13c37..98ec128d5 100644
--- a/resources/views/livewire/notifications/telegram.blade.php
+++ b/resources/views/livewire/notifications/telegram.blade.php
@@ -24,12 +24,21 @@
             <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSaveTelegramEnabled" id="telegramEnabled" label="Enabled" />
         </div>
         <div class="flex gap-2">
-            <x-forms.input canGate="update" :canResource="$settings" type="password" autocomplete="new-password"
-                helper="Get it from the <a class='inline-block underline dark:text-white' href='https://t.me/botfather' target='_blank'>BotFather Bot</a> on Telegram."
-                required id="telegramToken" label="Bot API Token" />
-            <x-forms.input canGate="update" :canResource="$settings" type="password" autocomplete="new-password"
-                helper="Add your bot to a group chat and add its Chat ID here." required id="telegramChatId"
-                label="Chat ID" />
+            @can('update', $settings)
+                <x-forms.input type="password" autocomplete="new-password"
+                    helper="Get it from the <a class='inline-block underline dark:text-white' href='https://t.me/botfather' target='_blank'>BotFather Bot</a> on Telegram."
+                    required id="telegramToken" label="Bot API Token" />
+                <x-forms.input type="password" autocomplete="new-password"
+                    helper="Add your bot to a group chat and add its Chat ID here." required id="telegramChatId"
+                    label="Chat ID" />
+            @else
+                <x-forms.input disabled autocomplete="new-password"
+                    helper="Get it from the <a class='inline-block underline dark:text-white' href='https://t.me/botfather' target='_blank'>BotFather Bot</a> on Telegram."
+                    required label="Bot API Token" value="Hidden (only admins can view)" />
+                <x-forms.input disabled autocomplete="new-password"
+                    helper="Add your bot to a group chat and add its Chat ID here." required label="Chat ID"
+                    value="Hidden (only admins can view)" />
+            @endcan
         </div>
     </form>
     <h2 class="mt-4">Notification Settings</h2>
diff --git a/resources/views/livewire/notifications/webhook.blade.php b/resources/views/livewire/notifications/webhook.blade.php
index 7c32311bf..4bacb6091 100644
--- a/resources/views/livewire/notifications/webhook.blade.php
+++ b/resources/views/livewire/notifications/webhook.blade.php
@@ -28,9 +28,15 @@
         </div>
         <div class="flex items-end gap-2">
 
-            <x-forms.input canGate="update" :canResource="$settings" type="password"
-                helper="Enter a valid HTTP or HTTPS URL. Coolify will send POST requests to this endpoint when events occur."
-                required id="webhookUrl" label="Webhook URL (POST)" />
+            @can('update', $settings)
+                <x-forms.input type="password"
+                    helper="Enter a valid HTTP or HTTPS URL. Coolify will send POST requests to this endpoint when events occur."
+                    required id="webhookUrl" label="Webhook URL (POST)" />
+            @else
+                <x-forms.input disabled
+                    helper="Enter a valid HTTP or HTTPS URL. Coolify will send POST requests to this endpoint when events occur."
+                    required label="Webhook URL (POST)" value="Hidden (only admins can view)" />
+            @endcan
         </div>
     </form>
     <h2 class="mt-4">Notification Settings</h2>
diff --git a/resources/views/livewire/project/application/deployment/show.blade.php b/resources/views/livewire/project/application/deployment/show.blade.php
index bc1c3c634..1e9b64386 100644
--- a/resources/views/livewire/project/application/deployment/show.blade.php
+++ b/resources/views/livewire/project/application/deployment/show.blade.php
@@ -338,6 +338,7 @@
                                             class="block w-full px-4 py-2 text-left text-sm text-gray-700 dark:text-gray-200 hover:bg-gray-100 dark:hover:bg-coolgray-300">
                                             Download displayed logs
                                         </button>
+                                        @can('update', $application)
                                         <button x-on:click="
                                             downloadingAllLogs = true;
                                             $wire.downloadAllLogs().then(logs => {
@@ -368,6 +369,7 @@
                                                 Downloading...
                                             </span>
                                         </button>
+                                        @endcan
                                     </div>
                                 </div>
                             </div>
@@ -380,6 +382,7 @@
                                         d="M12 6v6h4.5m4.5 0a9 9 0 1 1-18 0 9 9 0 0 1 18 0Z" />
                                 </svg>
                             </button>
+                            @can('update', $application)
                             <button wire:click="toggleDebug"
                                 title="{{ $is_debug_enabled ? 'Hide Debug Logs' : 'Show Debug Logs' }}"
                                 class="p-1 text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-gray-200 {{ $is_debug_enabled ? '!text-warning' : '' }}">
@@ -389,6 +392,7 @@
                                         d="M12 12.75c1.148 0 2.278.08 3.383.237 1.037.146 1.866.966 1.866 2.013 0 3.728-2.35 6.75-5.25 6.75S6.75 18.728 6.75 15c0-1.046.83-1.867 1.866-2.013A24.204 24.204 0 0 1 12 12.75Zm0 0c2.883 0 5.647.508 8.207 1.44a23.91 23.91 0 0 1-1.152 6.06M12 12.75c-2.883 0-5.647.508-8.208 1.44.125 2.104.52 4.136 1.153 6.06M12 12.75a2.25 2.25 0 0 0 2.248-2.354M12 12.75a2.25 2.25 0 0 1-2.248-2.354M12 8.25c.995 0 1.971-.08 2.922-.236.403-.066.74-.358.795-.762a3.778 3.778 0 0 0-.399-2.25M12 8.25c-.995 0-1.97-.08-2.922-.236-.402-.066-.74-.358-.795-.762a3.734 3.734 0 0 1 .4-2.253M12 8.25a2.25 2.25 0 0 0-2.248 2.146M12 8.25a2.25 2.25 0 0 1 2.248 2.146M8.683 5a6.032 6.032 0 0 1-1.155-1.002c.07-.63.27-1.222.574-1.747m.581 2.749A3.75 3.75 0 0 1 15.318 5m0 0c.427-.283.815-.62 1.155-.999a4.471 4.471 0 0 0-.575-1.752M4.921 6a24.048 24.048 0 0 0-.392 3.314c1.668.546 3.416.914 5.223 1.082M19.08 6c.205 1.08.337 2.187.392 3.314a23.882 23.882 0 0 1-5.223 1.082" />
                                 </svg>
                             </button>
+                            @endcan
                             <button title="Follow Logs" :class="alwaysScroll ? '!text-warning' : ''"
                                 x-on:click="toggleScroll"
                                 class="p-1 text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-gray-200">
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index 18e2e6db0..443234869 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -483,13 +483,14 @@
                     <div class="flex flex-wrap gap-2">
                         @if (!str($application->status)->startsWith('exited'))
                             @if (!$application->destination->server->isSwarm())
+
                                 <x-modal-confirmation title="Confirm Application Deployment?" buttonTitle="Redeploy"
                                     submitAction="deploy" :actions="[
                                         'This application will be redeployed.',
                                     ]" :confirmWithText="false" :confirmWithPassword="false"
                                     step2ButtonText="Confirm">
                                     <x-slot:content>
-                                        <x-forms.button title="With rolling update if possible">
+                                        <x-forms.button canGate="deploy" :canResource="$application" title="With rolling update if possible">
                                             <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-orange-400"
                                                 viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" fill="none"
                                                 stroke-linecap="round" stroke-linejoin="round">
@@ -512,7 +513,7 @@
                                         ]" :confirmWithText="false" :confirmWithPassword="false"
                                         step2ButtonText="Confirm">
                                         <x-slot:content>
-                                            <x-forms.button title="Redeploy Swarm Service (rolling update)">
+                                            <x-forms.button canGate="deploy" :canResource="$application" title="Redeploy Swarm Service (rolling update)">
                                                 <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
                                                     xmlns="http://www.w3.org/2000/svg">
                                                     <g fill="none" stroke="currentColor" stroke-linecap="round"
@@ -533,7 +534,7 @@
                                         ]" :confirmWithText="false" :confirmWithPassword="false"
                                         step2ButtonText="Confirm">
                                         <x-slot:content>
-                                            <x-forms.button title="Restart without rebuilding">
+                                            <x-forms.button canGate="deploy" :canResource="$application" title="Restart without rebuilding">
                                                 <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
                                                     xmlns="http://www.w3.org/2000/svg">
                                                     <g fill="none" stroke="currentColor" stroke-linecap="round"
@@ -547,9 +548,10 @@
                                             </x-forms.button>
                                         </x-slot:content>
                                     </x-modal-confirmation>
+
                                 @endif
                             @endif
-                            <x-modal-confirmation title="Confirm Application Stopping?" buttonTitle="Stop"
+                            <x-modal-confirmation :disabled="!auth()->user()->can('deploy', $application)" :authDisabled="!auth()->user()->can('deploy', $application)" title="Confirm Application Stopping?" buttonTitle="Stop"
                                 submitAction="stop" :checkboxes="$checkboxes" :actions="[
                                     'This application will be stopped.',
                                     'All non-persistent data of this application will be deleted.',
@@ -571,13 +573,14 @@
                                 </x-slot:button-title>
                             </x-modal-confirmation>
                         @else
+
                             <x-modal-confirmation title="Confirm Application Deployment?" buttonTitle="Deploy"
                                 submitAction="deploy" :actions="[
                                     'This application will be deployed.',
                                 ]" :confirmWithText="false" :confirmWithPassword="false"
                                 step2ButtonText="Confirm">
                                 <x-slot:content>
-                                    <x-forms.button>
+                                    <x-forms.button canGate="deploy" :canResource="$application">
                                         <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning"
                                             viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" fill="none"
                                             stroke-linecap="round" stroke-linejoin="round">
@@ -588,6 +591,7 @@
                                     </x-forms.button>
                                 </x-slot:content>
                             </x-modal-confirmation>
+
                         @endif
                     </div>
                 </div>
diff --git a/resources/views/livewire/project/database/backup-edit.blade.php b/resources/views/livewire/project/database/backup-edit.blade.php
index 898283afd..8a4b89e5b 100644
--- a/resources/views/livewire/project/database/backup-edit.blade.php
+++ b/resources/views/livewire/project/database/backup-edit.blade.php
@@ -5,7 +5,7 @@
             Save
         </x-forms.button>
         @if (str($status)->startsWith('running'))
-            <livewire:project.database.backup-now :backup="$backup" />
+            <x-forms.button wire:click='backupNow'>Backup Now</x-forms.button>
         @endif
         @if ($backup->database_id !== 0)
             <x-modal-confirmation title="Confirm Backup Schedule Deletion?" buttonTitle="Delete Backups and Schedule"
diff --git a/resources/views/livewire/project/database/clickhouse/general.blade.php b/resources/views/livewire/project/database/clickhouse/general.blade.php
index ff0f6d7d5..d4ee9b8e3 100644
--- a/resources/views/livewire/project/database/clickhouse/general.blade.php
+++ b/resources/views/livewire/project/database/clickhouse/general.blade.php
@@ -20,8 +20,12 @@
             <div class="flex gap-2">
                 <x-forms.input label="Initial Username" id="clickhouseAdminUser" placeholder="If empty: clickhouse"
                     readonly helper="You can only change this in the database." canGate="update" :canResource="$database" />
-                <x-forms.input label="Initial Password" id="clickhouseAdminPassword" type="password" required readonly
-                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Initial Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Initial Password" id="clickhouseAdminPassword" type="password" required readonly
+                        helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @endif
             </div>
         @else
             <div class=" dark:text-warning">Please verify these values. You can only modify them before the initial
@@ -29,8 +33,12 @@
             </div>
             <div class="flex gap-2">
                 <x-forms.input label="Username" id="clickhouseAdminUser" required canGate="update" :canResource="$database" />
-                <x-forms.input label="Password" id="clickhouseAdminPassword" type="password" required canGate="update"
-                    :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Password" id="clickhouseAdminPassword" type="password" required canGate="update"
+                        :canResource="$database" />
+                @endif
             </div>
         @endif
         <x-forms.input
diff --git a/resources/views/livewire/project/database/dragonfly/general.blade.php b/resources/views/livewire/project/database/dragonfly/general.blade.php
index fc466b5a7..04ede2ea0 100644
--- a/resources/views/livewire/project/database/dragonfly/general.blade.php
+++ b/resources/views/livewire/project/database/dragonfly/general.blade.php
@@ -21,16 +21,24 @@
 
         @if ($database->started_at)
             <div class="flex gap-2">
-                <x-forms.input label="Initial Password" id="dragonflyPassword" type="password" required readonly
-                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Initial Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Initial Password" id="dragonflyPassword" type="password" required readonly
+                        helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @endif
             </div>
         @else
             <div class=" dark:text-warning">Please verify these values. You can only modify them before the initial
                 start. After that, you need to modify it in the database.
             </div>
             <div class="flex gap-2">
-                <x-forms.input label="Password" id="dragonflyPassword" type="password" required canGate="update"
-                    :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Password" id="dragonflyPassword" type="password" required canGate="update"
+                        :canResource="$database" />
+                @endif
             </div>
         @endif
         <div class="flex flex-col gap-2">
diff --git a/resources/views/livewire/project/database/heading.blade.php b/resources/views/livewire/project/database/heading.blade.php
index 61670cc72..ca4fcf1ea 100644
--- a/resources/views/livewire/project/database/heading.blade.php
+++ b/resources/views/livewire/project/database/heading.blade.php
@@ -216,7 +216,8 @@
             <div class="flex flex-wrap gap-2 items-center">
                 <div class="hidden flex-wrap items-center gap-2 md:flex">
                     @if (!str($database->status)->startsWith('exited'))
-                        <x-forms.button title="Restart" @click="document.getElementById('database-restart-trigger')?.click()">
+
+                        <x-forms.button canGate="manage" :canResource="$database" title="Restart" @click="document.getElementById('database-restart-trigger')?.click()">
                             <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
                                 xmlns="http://www.w3.org/2000/svg">
                                 <g fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"
@@ -227,7 +228,7 @@
                             </svg>
                             Restart
                         </x-forms.button>
-                        <x-forms.button isError title="Stop" @click="document.getElementById('database-stop-trigger')?.click()">
+                        <x-forms.button canGate="manage" :canResource="$database" isError title="Stop" @click="document.getElementById('database-stop-trigger')?.click()">
                             <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
                                 stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
                                 stroke-linejoin="round">
@@ -241,7 +242,8 @@
                             Stop
                         </x-forms.button>
                     @else
-                        <button @click="document.getElementById('database-start-trigger')?.click()" class="gap-2 button">
+                        <x-forms.button canGate="manage" :canResource="$database" @click="document.getElementById('database-start-trigger')?.click()" class="gap-2">
+
                             <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
                                 stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
                                 stroke-linejoin="round">
@@ -249,7 +251,7 @@
                                 <path d="M7 4v16l13 -8z" />
                             </svg>
                             Start
-                        </button>
+                        </x-forms.button>
                     @endif
                 </div>
                 @script
diff --git a/resources/views/livewire/project/database/keydb/general.blade.php b/resources/views/livewire/project/database/keydb/general.blade.php
index 9b9ed55de..74c92bb61 100644
--- a/resources/views/livewire/project/database/keydb/general.blade.php
+++ b/resources/views/livewire/project/database/keydb/general.blade.php
@@ -18,16 +18,24 @@
 
         @if ($database->started_at)
             <div class="flex gap-2">
-                <x-forms.input label="Initial Password" id="keydbPassword" type="password" required readonly
-                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Initial Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Initial Password" id="keydbPassword" type="password" required readonly
+                        helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @endif
             </div>
         @else
             <div class=" dark:text-warning">Please verify these values. You can only modify them before the initial
                 start. After that, you need to modify it in the database.
             </div>
             <div class="flex gap-2">
-                <x-forms.input label="Password" id="keydbPassword" type="password" required canGate="update"
-                    :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Password" id="keydbPassword" type="password" required canGate="update"
+                        :canResource="$database" />
+                @endif
             </div>
         @endif
         <x-forms.input
diff --git a/resources/views/livewire/project/database/mariadb/general.blade.php b/resources/views/livewire/project/database/mariadb/general.blade.php
index 701279ddb..2eb79cc2d 100644
--- a/resources/views/livewire/project/database/mariadb/general.blade.php
+++ b/resources/views/livewire/project/database/mariadb/general.blade.php
@@ -20,15 +20,23 @@
         </div>
         @if ($database->started_at)
             <div class="flex xl:flex-row flex-col gap-2">
-                <x-forms.input label="Root Password" id="mariadbRootPassword" type="password" required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
-                    canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Root Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Root Password" id="mariadbRootPassword" type="password" required
+                        helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
+                        canGate="update" :canResource="$database" />
+                @endif
                 <x-forms.input label="Normal User" id="mariadbUser" required
                     helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
                     canGate="update" :canResource="$database" />
-                <x-forms.input label="Normal User Password" id="mariadbPassword" type="password" required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
-                    canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Normal User Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Normal User Password" id="mariadbPassword" type="password" required
+                        helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
+                        canGate="update" :canResource="$database" />
+                @endif
             </div>
             <div class="flex flex-col gap-2">
                 <x-forms.input label="Initial Database" id="mariadbDatabase"
@@ -37,12 +45,20 @@
             </div>
         @else
             <div class="flex xl:flex-row flex-col gap-2 pb-2">
-                <x-forms.input label="Root Password" id="mariadbRootPassword" type="password"
-                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Root Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Root Password" id="mariadbRootPassword" type="password"
+                        helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @endif
                 <x-forms.input label="Normal User" id="mariadbUser" required
                     helper="You can only change this in the database." canGate="update" :canResource="$database" />
-                <x-forms.input label="Normal User Password" id="mariadbPassword" type="password" required
-                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Normal User Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Normal User Password" id="mariadbPassword" type="password" required
+                        helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @endif
             </div>
             <div class="flex flex-col gap-2">
                 <x-forms.input label="Initial Database" id="mariadbDatabase"
diff --git a/resources/views/livewire/project/database/mongodb/general.blade.php b/resources/views/livewire/project/database/mongodb/general.blade.php
index 293fbeb04..f0684f2b0 100644
--- a/resources/views/livewire/project/database/mongodb/general.blade.php
+++ b/resources/views/livewire/project/database/mongodb/general.blade.php
@@ -24,10 +24,14 @@
                     placeholder="If empty: postgres"
                     helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
                     canGate="update" :canResource="$database" />
-                <x-forms.input label="Initial Password" id="mongoInitdbRootPassword" type="password"
-                    required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
-                    canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Initial Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Initial Password" id="mongoInitdbRootPassword" type="password"
+                        required
+                        helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
+                        canGate="update" :canResource="$database" />
+                @endif
                 <x-forms.input label="Initial Database" id="mongoInitdbDatabase"
                     placeholder="If empty, it will be the same as Username." readonly
                     helper="You can only change this in the database." canGate="update" :canResource="$database" />
@@ -36,8 +40,12 @@
             <div class="flex xl:flex-row flex-col gap-2 pb-2">
                 <x-forms.input required label="Username" id="mongoInitdbRootUsername"
                     placeholder="If empty: postgres" canGate="update" :canResource="$database" />
-                <x-forms.input label="Password" id="mongoInitdbRootPassword" type="password" required
-                    canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Password" id="mongoInitdbRootPassword" type="password" required
+                        canGate="update" :canResource="$database" />
+                @endif
                 <x-forms.input required label="Database" id="mongoInitdbDatabase"
                     placeholder="If empty, it will be the same as Username." canGate="update" :canResource="$database" />
             </div>
diff --git a/resources/views/livewire/project/database/mysql/general.blade.php b/resources/views/livewire/project/database/mysql/general.blade.php
index 23280ce04..0afd9db19 100644
--- a/resources/views/livewire/project/database/mysql/general.blade.php
+++ b/resources/views/livewire/project/database/mysql/general.blade.php
@@ -20,12 +20,20 @@
         </div>
         @if ($database->started_at)
             <div class="flex xl:flex-row flex-col gap-2">
-                <x-forms.input label="Root Password" id="mysqlRootPassword" type="password" required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Root Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Root Password" id="mysqlRootPassword" type="password" required
+                        helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." canGate="update" :canResource="$database" />
+                @endif
                 <x-forms.input label="Normal User" id="mysqlUser" required
                     helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." canGate="update" :canResource="$database" />
-                <x-forms.input label="Normal User Password" id="mysqlPassword" type="password" required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Normal User Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Normal User Password" id="mysqlPassword" type="password" required
+                        helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." canGate="update" :canResource="$database" />
+                @endif
             </div>
             <div class="flex flex-col gap-2">
                 <x-forms.input label="Initial Database" id="mysqlDatabase"
@@ -34,12 +42,20 @@
             </div>
         @else
             <div class="flex xl:flex-row flex-col gap-4 pb-2">
-                <x-forms.input label="Root Password" id="mysqlRootPassword" type="password"
-                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Root Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Root Password" id="mysqlRootPassword" type="password"
+                        helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @endif
                 <x-forms.input label="Normal User" id="mysqlUser" required
                     helper="You can only change this in the database." canGate="update" :canResource="$database" />
-                <x-forms.input label="Normal User Password" id="mysqlPassword" type="password" required
-                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Normal User Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Normal User Password" id="mysqlPassword" type="password" required
+                        helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                @endif
             </div>
             <div class="flex flex-col gap-2">
                 <x-forms.input label="Initial Database" id="mysqlDatabase"
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index 278dd94c2..f81fa63fd 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -37,9 +37,13 @@
                 <x-forms.input label="Username" id="postgresUser" placeholder="If empty: postgres" canGate="update"
                     :canResource="$database"
                     helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
-                <x-forms.input label="Password" id="postgresPassword" type="password" required canGate="update"
-                    :canResource="$database"
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Password" id="postgresPassword" type="password" required canGate="update"
+                        :canResource="$database"
+                        helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
+                @endif
                 <x-forms.input label="Initial Database" id="postgresDb"
                     placeholder="If empty, it will be the same as Username." readonly
                     helper="You can only change this in the database." />
@@ -48,8 +52,12 @@
             <div class="flex xl:flex-row flex-col gap-2 pb-2">
                 <x-forms.input label="Username" id="postgresUser" placeholder="If empty: postgres" canGate="update"
                     :canResource="$database" />
-                <x-forms.input label="Password" id="postgresPassword" type="password" required canGate="update"
-                    :canResource="$database" />
+                @if ($isPasswordHiddenForMember)
+                    <x-forms.input label="Password" disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input label="Password" id="postgresPassword" type="password" required canGate="update"
+                        :canResource="$database" />
+                @endif
                 <x-forms.input label="Initial Database" id="postgresDb"
                     placeholder="If empty, it will be the same as Username." canGate="update" :canResource="$database" />
             </div>
@@ -134,7 +142,8 @@
             </div>
             <div class="flex flex-col gap-2">
                 @forelse($initScripts ?? [] as $script)
-                    <livewire:project.database.init-script :script="$script" :wire:key="$script['index']" />
+                    <livewire:project.database.init-script :database="$database" :script="$script"
+                        :wire:key="$script['index']" />
                 @empty
                     <div>No initialization scripts found.</div>
                 @endforelse
diff --git a/resources/views/livewire/project/database/redis/general.blade.php b/resources/views/livewire/project/database/redis/general.blade.php
index c153955d8..9d317f6bf 100644
--- a/resources/views/livewire/project/database/redis/general.blade.php
+++ b/resources/views/livewire/project/database/redis/general.blade.php
@@ -26,8 +26,12 @@
                         <x-forms.input label="Username" id="redisUsername"
                             helper="You can only change this in the database." canGate="update" :canResource="$database" />
                     @endif
-                    <x-forms.input label="Password" id="redisPassword" type="password"
-                        helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                    @if ($isPasswordHiddenForMember)
+                        <x-forms.input label="Password" disabled value="Hidden (only admins can view)" />
+                    @else
+                        <x-forms.input label="Password" id="redisPassword" type="password"
+                            helper="You can only change this in the database." canGate="update" :canResource="$database" />
+                    @endif
                 </div>
             @else
                 <div class="pt-2 dark:text-warning">You can only change the username and password in the database after
@@ -42,13 +46,17 @@
                     Note: If the environment variable REDIS_USERNAME is set as a shared variable (environment, project, or team-based), this input field will become read-only."
                             :disabled="$this->isSharedVariable('REDIS_USERNAME')" canGate="update" :canResource="$database" />
                     @endif
-                    <x-forms.input label="Password" id="redisPassword" type="password" required
-                        helper="You can change the Redis Password in the input field below or by editing the value of the REDIS_PASSWORD environment variable.
+                    @if ($isPasswordHiddenForMember)
+                        <x-forms.input label="Password" disabled value="Hidden (only admins can view)" />
+                    @else
+                        <x-forms.input label="Password" id="redisPassword" type="password" required
+                            helper="You can change the Redis Password in the input field below or by editing the value of the REDIS_PASSWORD environment variable.
                 <br><br>
                 If you change the Redis Password in the database, please sync it here, otherwise automations (like backups) won't work.
                 <br><br>
                 Note: If the environment variable REDIS_PASSWORD is set as a shared variable (environment, project, or team-based), this input field will become read-only."
-                        :disabled="$this->isSharedVariable('REDIS_PASSWORD')" canGate="update" :canResource="$database" />
+                            :disabled="$this->isSharedVariable('REDIS_PASSWORD')" canGate="update" :canResource="$database" />
+                    @endif
                 </div>
             @endif
         </div>
diff --git a/resources/views/livewire/project/database/status-info.blade.php b/resources/views/livewire/project/database/status-info.blade.php
index 7107b3daf..3e3c97c80 100644
--- a/resources/views/livewire/project/database/status-info.blade.php
+++ b/resources/views/livewire/project/database/status-info.blade.php
@@ -2,5 +2,6 @@
     <x-database-status-info :database="$database" :label="$label" :db-url="$dbUrl" :db-url-public="$dbUrlPublic"
         :enable-ssl="$enableSsl" :ssl-mode="$sslMode" :certificate-valid-until="$certificateValidUntil"
         :supports-ssl="$supportsSsl" :ssl-mode-options="$sslModeOptions" :ssl-mode-helper="$sslModeHelper"
-        :show-public-url-placeholder="$showPublicUrlPlaceholder" :is-exited="$isExited" />
+        :show-public-url-placeholder="$showPublicUrlPlaceholder" :is-exited="$isExited"
+        :is-password-hidden-for-member="$isPasswordHiddenForMember" />
 </div>
diff --git a/resources/views/livewire/project/service/file-storage.blade.php b/resources/views/livewire/project/service/file-storage.blade.php
index b7f68c6ec..2a14d9350 100644
--- a/resources/views/livewire/project/service/file-storage.blade.php
+++ b/resources/views/livewire/project/service/file-storage.blade.php
@@ -100,7 +100,7 @@
             @else
                 {{-- Read-only view --}}
                 @if (!$fileStorage->is_directory)
-                    @can('view', $resource)
+                    @can('update', $resource)
                         <div class="flex gap-2">
                             <x-forms.button type="button" wire:click="loadStorageOnServer">Load from
                                 server</x-forms.button>
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index 1071bd658..820d99080 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -369,7 +369,9 @@
                 <div class="flex flex-wrap items-center gap-2">
                     <x-services.advanced :service="$service" />
                     @if (str($service->status)->contains('running'))
-                        <x-forms.button title="Restart" @click="document.getElementById('service-restart-trigger')?.click()">
+
+                        <x-forms.button canGate="deploy" :canResource="$service" title="Restart" @click="document.getElementById('service-restart-trigger')?.click()">
+
                             <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
                                 <g fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"
                                     stroke-width="2">
@@ -379,7 +381,8 @@
                             </svg>
                             Restart
                         </x-forms.button>
-                        <x-forms.button isError title="Stop" @click="document.getElementById('service-stop-trigger')?.click()">
+
+                        <x-forms.button canGate="stop" :canResource="$service" isError title="Stop" @click="document.getElementById('service-stop-trigger')?.click()">
                             <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
                                 stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
                                 stroke-linejoin="round">
@@ -393,7 +396,8 @@
                             Stop
                         </x-forms.button>
                     @elseif (str($service->status)->contains('degraded'))
-                        <x-forms.button title="Restart" @click="document.getElementById('service-restart-trigger')?.click()">
+                        <x-forms.button canGate="deploy" :canResource="$service" title="Restart" @click="document.getElementById('service-restart-trigger')?.click()">
+
                             <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
                                 <g fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"
                                     stroke-width="2">
@@ -403,7 +407,8 @@
                             </svg>
                             Restart
                         </x-forms.button>
-                        <x-forms.button isError title="Stop" @click="document.getElementById('service-stop-trigger')?.click()">
+
+                        <x-forms.button canGate="stop" :canResource="$service" isError title="Stop" @click="document.getElementById('service-stop-trigger')?.click()">
                             <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
                                 stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
                                 stroke-linejoin="round">
@@ -417,7 +422,8 @@
                             Stop
                         </x-forms.button>
                     @elseif (str($service->status)->contains('exited'))
-                        <button @click="document.getElementById('service-start-trigger')?.click()" class="gap-2 button">
+                        <x-forms.button canGate="deploy" :canResource="$service" @click="document.getElementById('service-start-trigger')?.click()" class="gap-2">
+
                             <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
                                 stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
                                 stroke-linejoin="round">
@@ -425,9 +431,10 @@
                                 <path d="M7 4v16l13 -8z" />
                             </svg>
                             Deploy
-                        </button>
+                        </x-forms.button>
                     @else
-                        <x-forms.button isError title="Stop" @click="document.getElementById('service-stop-trigger')?.click()">
+
+                        <x-forms.button canGate="stop" :canResource="$service" isError title="Stop" @click="document.getElementById('service-stop-trigger')?.click()">
                             <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
                                 stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
                                 stroke-linejoin="round">
@@ -440,7 +447,8 @@
                             </svg>
                             Stop
                         </x-forms.button>
-                        <button @click="document.getElementById('service-start-trigger')?.click()" class="gap-2 button">
+                        <x-forms.button canGate="deploy" :canResource="$service" @click="document.getElementById('service-start-trigger')?.click()" class="gap-2">
+
                             <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
                                 stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
                                 stroke-linejoin="round">
@@ -448,7 +456,7 @@
                                 <path d="M7 4v16l13 -8z" />
                             </svg>
                             Deploy
-                        </button>
+                        </x-forms.button>
                     @endif
                 </div>
             </div>
@@ -522,11 +530,9 @@
                     );
                     return;
                 }
-                window.dispatchEvent(new CustomEvent('startservice'));
                 $wire.$call('start');
             });
             $wire.$on('forceDeployEvent', () => {
-                window.dispatchEvent(new CustomEvent('startservice'));
                 $wire.$call('forceDeploy');
             });
             $wire.$on('restartEvent', async () => {
@@ -539,12 +545,10 @@
                 }
                 $wire.$dispatch('info',
                     'Gracefully stopping service.<br/><br/>It could take a while depending on the service.');
-                window.dispatchEvent(new CustomEvent('startservice'));
                 $wire.$call('restart');
             });
             $wire.$on('pullAndRestartEvent', () => {
                 $wire.$dispatch('info', 'Pulling new images and restarting service.');
-                window.dispatchEvent(new CustomEvent('startservice'));
                 $wire.$call('pullAndRestartEvent');
             });
             $wire.$on('cleanupEvent', () => {
diff --git a/resources/views/livewire/project/service/stack-form.blade.php b/resources/views/livewire/project/service/stack-form.blade.php
index 0aec7c873..37e5f5924 100644
--- a/resources/views/livewire/project/service/stack-form.blade.php
+++ b/resources/views/livewire/project/service/stack-form.blade.php
@@ -45,10 +45,14 @@
                         <x-helper helper="Variable name: {{ $serviceName }}" />
                     @endif
                 </div>
-                <x-forms.input canGate="update" :canResource="$service"
-                    type="{{ data_get($field, 'isPassword') ? 'password' : 'text' }}"
-                    required="{{ str(data_get($field, 'rules'))?->contains('required') }}"
-                    id="fields.{{ $serviceName }}.value"></x-forms.input>
+                @if ($isPasswordHiddenForMember && data_get($field, 'isPassword'))
+                    <x-forms.input disabled value="Hidden (only admins can view)" />
+                @else
+                    <x-forms.input canGate="update" :canResource="$service"
+                        type="{{ data_get($field, 'isPassword') ? 'password' : 'text' }}"
+                        required="{{ str(data_get($field, 'rules'))?->contains('required') }}"
+                        id="fields.{{ $serviceName }}.value"></x-forms.input>
+                @endif
             @endforeach
         </div>
     @endif
diff --git a/resources/views/livewire/project/shared/environment-variable/show.blade.php b/resources/views/livewire/project/shared/environment-variable/show.blade.php
index cbb7afa2f..c602ba4af 100644
--- a/resources/views/livewire/project/shared/environment-variable/show.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/show.blade.php
@@ -184,6 +184,7 @@
                             @endif
                         </div>
                         <x-forms.input instantSave id="comment" label="Comment"
+                            placeholder="{{ $isMagicVariable ? 'This env cannot be edited manually, it is handled by Coolify.' : '' }}"
                             helper="Add a note to document what this environment variable is used for." maxlength="256" />
                     </div>
                 @endif
@@ -191,16 +192,23 @@
                 <div class="flex flex-col w-full gap-2">
                     <div class="flex flex-col w-full gap-2 lg:flex-row">
                         <x-forms.input disabled id="key" />
-                        <x-forms.env-var-input
-                            disabled
-                            type="password"
-                            id="value"
-                            :availableVars="$isSharedVariable ? [] : $this->availableSharedVariables"
-                            :projectUuid="data_get($parameters, 'project_uuid')"
-                            :environmentUuid="data_get($parameters, 'environment_uuid')"
-                            :serverUuid="data_get($parameters, 'server_uuid')" />
-                        @if ($is_shared)
-                            <x-forms.input disabled type="password" id="real_value" />
+                        @if ($isValueHidden)
+                            <div class="w-full">
+                                <input disabled type="text" value="Hidden (only admins can view)"
+                                    class="input italic !text-neutral-500 dark:!text-neutral-500" />
+                            </div>
+                        @else
+                            <x-forms.env-var-input
+                                disabled
+                                type="password"
+                                id="value"
+                                :availableVars="$isSharedVariable ? [] : $this->availableSharedVariables"
+                                :projectUuid="data_get($parameters, 'project_uuid')"
+                                :environmentUuid="data_get($parameters, 'environment_uuid')"
+                                :serverUuid="data_get($parameters, 'server_uuid')" />
+                            @if ($is_shared)
+                                <x-forms.input disabled type="password" id="real_value" />
+                            @endif
                         @endif
                     </div>
                     <x-forms.input disabled id="comment" label="Comment"
diff --git a/resources/views/livewire/project/shared/health-checks.blade.php b/resources/views/livewire/project/shared/health-checks.blade.php
index ac2063c2e..f69fd71a4 100644
--- a/resources/views/livewire/project/shared/health-checks.blade.php
+++ b/resources/views/livewire/project/shared/health-checks.blade.php
@@ -3,12 +3,12 @@
         <h2>Healthcheck</h2>
         <x-forms.button canGate="update" :canResource="$resource" type="submit">Save</x-forms.button>
         @if (!$healthCheckEnabled)
-            <x-modal-confirmation title="Confirm Healthcheck Enable?" buttonTitle="Enable Healthcheck"
-                submitAction="toggleHealthcheck" :actions="['Enable healthcheck for this resource.']"
-                warningMessage="If the health check fails, your application will become inaccessible. Please review the <a href='https://coolify.io/docs/knowledge-base/health-checks' target='_blank' class='underline text-white'>Health Checks</a> guide before proceeding!"
-                step2ButtonText="Enable Healthcheck" :confirmWithText="false" :confirmWithPassword="false"
-                isHighlightedButton>
-            </x-modal-confirmation>
+                <x-modal-confirmation :disabled="!auth()->user()->can('update', $resource)" :authDisabled="!auth()->user()->can('update', $resource)" title="Confirm Healthcheck Enable?" buttonTitle="Enable Healthcheck"
+                    submitAction="toggleHealthcheck" :actions="['Enable healthcheck for this resource.']"
+                    warningMessage="If the health check fails, your application will become inaccessible. Please review the <a href='https://coolify.io/docs/knowledge-base/health-checks' target='_blank' class='underline text-white'>Health Checks</a> guide before proceeding!"
+                    step2ButtonText="Enable Healthcheck" :confirmWithText="false" :confirmWithPassword="false"
+                    isHighlightedButton>
+                </x-modal-confirmation>
         @else
             <x-forms.button canGate="update" :canResource="$resource" wire:click="toggleHealthcheck">Disable Healthcheck</x-forms.button>
         @endif
diff --git a/resources/views/livewire/project/shared/resource-details.blade.php b/resources/views/livewire/project/shared/resource-details.blade.php
index 3be82da12..62b04f2a0 100644
--- a/resources/views/livewire/project/shared/resource-details.blade.php
+++ b/resources/views/livewire/project/shared/resource-details.blade.php
@@ -1,6 +1,4 @@
-<div class="w-full max-h-[70vh] overflow-y-auto pr-1 -mt-4">
-    <div class="pb-4 text-sm dark:text-neutral-400">Identifiers for this resource. Read-only</div>
-
+<div class="w-full max-h-[70vh] overflow-y-auto pr-1 pt-1">
     <div class="flex flex-col gap-6">
         <div>
             <h3>Resource</h3>
diff --git a/resources/views/livewire/project/shared/resource-operations.blade.php b/resources/views/livewire/project/shared/resource-operations.blade.php
index 658a7cbd3..0c3c8885c 100644
--- a/resources/views/livewire/project/shared/resource-operations.blade.php
+++ b/resources/views/livewire/project/shared/resource-operations.blade.php
@@ -101,16 +101,10 @@
                     </div>
                 </div>
             </div>
-        @else
-            <x-callout type="warning" title="Access Restricted">
-                You don't have permission to clone resources. Contact your team administrator to request access.
-            </x-callout>
-        @endcan
 
-        <h3 class="pt-4">Move Resource</h3>
-        <div class="pb-4">Transfer this resource between projects and environments.</div>
+            <h3 class="pt-4">Move Resource</h3>
+            <div class="pb-4">Transfer this resource between projects and environments.</div>
 
-        @can('update', $resource)
             @if ($projects->count() > 0)
                 <div class="space-y-4">
                     <div class="flex flex-col lg:flex-row gap-4">
@@ -160,9 +154,8 @@
                 </div>
             @endif
         @else
-            <x-callout type="warning" title="Access Restricted">
-                You don't have permission to move resources between projects or environments. Contact your team
-                administrator to request access.
+            <x-callout type="danger" title="Insufficient Permissions">
+                You don't have permission to modify this resource. Contact your team administrator for access.
             </x-callout>
         @endcan
     </div>
diff --git a/resources/views/livewire/project/shared/scheduled-task/show.blade.php b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
index c699609c0..79e0f2604 100644
--- a/resources/views/livewire/project/shared/scheduled-task/show.blade.php
+++ b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
@@ -3,44 +3,47 @@
         <div class="flex flex-col gap-2 pb-2">
             <div class="flex gap-2 items-end">
                 <h2>Task {{ $task->name }}</h2>
-                <x-forms.button type="submit">
+                <x-forms.button canGate="update" :canResource="$resource" type="submit">
                     Save
                 </x-forms.button>
                 @if ($resource->isRunning())
-                    <x-forms.button type="button" wire:click="executeNow">
-                        Execute Now
-                    </x-forms.button>
+                    @can('update', $resource)
+                        <x-forms.button type="button" wire:click="executeNow">
+                            Execute Now
+                        </x-forms.button>
+                    @endcan
                 @endif
-                @if (!$isEnabled)
-                    <x-forms.button wire:click="toggleEnabled" isHighlighted>Enable Task</x-forms.button>
-                @else
-                    <x-forms.button wire:click="toggleEnabled">Disable Task</x-forms.button>
-                @endif
-                <x-modal-confirmation title="Confirm Scheduled Task Deletion?" isErrorButton buttonTitle="Delete"
-                    submitAction="delete({{ $task->id }})" :actions="['The selected scheduled task will be permanently deleted.']" confirmationText="{{ $task->name }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the Scheduled Task Name below"
-                    shortConfirmationLabel="Scheduled Task Name" :confirmWithPassword="false"
-                    step2ButtonText="Permanently Delete" />
-
+                @can('update', $resource)
+                    @if (!$isEnabled)
+                        <x-forms.button wire:click="toggleEnabled" isHighlighted>Enable Task</x-forms.button>
+                    @else
+                        <x-forms.button wire:click="toggleEnabled">Disable Task</x-forms.button>
+                    @endif
+                    <x-modal-confirmation title="Confirm Scheduled Task Deletion?" isErrorButton buttonTitle="Delete"
+                        submitAction="delete({{ $task->id }})" :actions="['The selected scheduled task will be permanently deleted.']" confirmationText="{{ $task->name }}"
+                        confirmationLabel="Please confirm the execution of the actions by entering the Scheduled Task Name below"
+                        shortConfirmationLabel="Scheduled Task Name" :confirmWithPassword="false"
+                        step2ButtonText="Permanently Delete" />
+                @endcan
             </div>
             <h3 class="pt-4">Configuration</h3>
             <div class="flex gap-2 w-full">
-                <x-forms.input placeholder="Name" id="name" label="Name" required />
-                <x-forms.input placeholder="0 0 * * * or daily" id="frequency" label="Frequency"
+                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" placeholder="Name" id="name" label="Name" required />
+                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" placeholder="0 0 * * * or daily" id="frequency" label="Frequency"
                     helper="You can use every_minute, hourly, daily, weekly, monthly, yearly or a cron expression." required />
-                <x-forms.input type="number" placeholder="300" id="timeout"
+                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" type="number" placeholder="300" id="timeout"
                     helper="Maximum execution time in seconds (60-36000)." label="Timeout (seconds)" required />
                 @if ($type === 'application')
-                    <x-forms.input placeholder="php"
+                    <x-forms.input :disabled="!auth()->user()->can('update', $resource)" placeholder="php"
                         helper="You can leave this empty if your resource only has one container." id="container"
                         label="Container name" />
                 @elseif ($type === 'service')
-                    <x-forms.input placeholder="php"
+                    <x-forms.input :disabled="!auth()->user()->can('update', $resource)" placeholder="php"
                         helper="You can leave this empty if your resource only has one service in your stack. Otherwise use the stack name, without the random generated ID. So if you have a mysql service in your stack, use mysql."
                         id="container" label="Service name" />
                 @endif
             </div>
-            <x-forms.input placeholder="php artisan schedule:run" id="command" label="Command" required />
+            <x-forms.input :disabled="!auth()->user()->can('update', $resource)" placeholder="php artisan schedule:run" id="command" label="Command" required />
     </form>
 
     <div class="pt-4">
diff --git a/resources/views/livewire/project/shared/tags.blade.php b/resources/views/livewire/project/shared/tags.blade.php
index 85208b75b..72b8214a9 100644
--- a/resources/views/livewire/project/shared/tags.blade.php
+++ b/resources/views/livewire/project/shared/tags.blade.php
@@ -10,8 +10,8 @@
             <x-forms.button type="submit">Add</x-forms.button>
         </form>
     @else
-        <x-callout type="warning" title="Access Restricted" class="mt-4">
-            You don't have permission to manage tags. Contact your team administrator to request access.
+        <x-callout type="danger" title="Insufficient Permissions" class="mt-4">
+            You don't have permission to manage this resource. Contact your team administrator for access.
         </x-callout>
     @endcan
     @if (data_get($this->resource, 'tags') && count(data_get($this->resource, 'tags')) > 0)
diff --git a/resources/views/livewire/project/shared/webhooks.blade.php b/resources/views/livewire/project/shared/webhooks.blade.php
index 24bba525a..bccc31383 100644
--- a/resources/views/livewire/project/shared/webhooks.blade.php
+++ b/resources/views/livewire/project/shared/webhooks.blade.php
@@ -22,9 +22,9 @@
                                 helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitHub."
                                 label="GitHub Webhook Secret" id="githubManualWebhookSecret"></x-forms.input>
                         @else
-                            <x-forms.input disabled type="password"
+                            <x-forms.input disabled
                                 helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitHub."
-                                label="GitHub Webhook Secret" id="githubManualWebhookSecret"></x-forms.input>
+                                label="GitHub Webhook Secret" value="Hidden (only admins can view)"></x-forms.input>
                         @endcan
                     </div>
                     <a target="_blank" class="flex hover:no-underline" href="{{ $resource?->gitWebhook }}">
@@ -39,9 +39,9 @@
                                 helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitLab."
                                 label="GitLab Webhook Secret" id="gitlabManualWebhookSecret"></x-forms.input>
                         @else
-                            <x-forms.input disabled type="password"
+                            <x-forms.input disabled
                                 helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitLab."
-                                label="GitLab Webhook Secret" id="gitlabManualWebhookSecret"></x-forms.input>
+                                label="GitLab Webhook Secret" value="Hidden (only admins can view)"></x-forms.input>
                         @endcan
                     </div>
                     <div class="flex gap-2">
@@ -51,9 +51,9 @@
                                 helper="Need to set a secret to be able to use this webhook. It should match with the secret in Bitbucket."
                                 label="Bitbucket Webhook Secret" id="bitbucketManualWebhookSecret"></x-forms.input>
                         @else
-                            <x-forms.input disabled type="password"
+                            <x-forms.input disabled
                                 helper="Need to set a secret to be able to use this webhook. It should match with the secret in Bitbucket."
-                                label="Bitbucket Webhook Secret" id="bitbucketManualWebhookSecret"></x-forms.input>
+                                label="Bitbucket Webhook Secret" value="Hidden (only admins can view)"></x-forms.input>
                         @endcan
                     </div>
                     <div class="flex gap-2">
@@ -63,9 +63,9 @@
                                 helper="Need to set a secret to be able to use this webhook. It should match with the secret in Gitea."
                                 label="Gitea Webhook Secret" id="giteaManualWebhookSecret"></x-forms.input>
                         @else
-                            <x-forms.input disabled type="password"
+                            <x-forms.input disabled
                                 helper="Need to set a secret to be able to use this webhook. It should match with the secret in Gitea."
-                                label="Gitea Webhook Secret" id="giteaManualWebhookSecret"></x-forms.input>
+                                label="Gitea Webhook Secret" value="Hidden (only admins can view)"></x-forms.input>
                         @endcan
                     </div>
                     @can('update', $resource)
diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index 69eab3e70..dc8c97952 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -24,20 +24,23 @@
                 </x-forms.select>
                 <x-forms.button type="submit">Create</x-forms.button>
             </div>
-            <div class="flex">
-                Permissions
-                <span
-                    class="pr-1">:</span>
-                <div class="flex gap-1 font-bold dark:text-white">
-                    @if ($permissions)
+            <div class="flex items-center gap-2">
+                <span>Permissions</span>
+                <x-helper helper="These permissions will be granted to the token." />
+                @if ($permissions)
+                    <div class="flex gap-1.5 flex-wrap">
                         @foreach ($permissions as $permission)
-                            <div>{{ $permission }}</div>
+                            <span
+                                class="px-2 py-0.5 text-xs rounded-sm font-medium {{ $permission === 'root' ? 'bg-red-500/20 text-red-400' : ($permission === 'write' || $permission === 'write:sensitive' ? 'bg-amber-500/20 text-amber-400' : ($permission === 'deploy' ? 'bg-blue-500/20 text-blue-400' : 'bg-neutral-500/20 text-neutral-300')) }}">
+                                {{ $permission }}
+                            </span>
                         @endforeach
-                    @endif
-                </div>
+                    </div>
+                @endif
             </div>
 
-            <div class="w-64">
+            <h4>Token Permissions</h4>
+            <div class="w-96">
                 @if ($canUseRootPermissions)
                     <x-forms.checkbox label="root" wire:model.live="permissions" domValue="root"
                         helper="Root access, be careful!" :checked="in_array('root', $permissions)"></x-forms.checkbox>
@@ -55,13 +58,23 @@
                             helper="Write access requires admin or owner role" :checked="false"></x-forms.checkbox>
                     @endif
 
-                    <x-forms.checkbox label="deploy" wire:model.live="permissions" domValue="deploy"
-                        helper="Can trigger deploy webhooks." :checked="in_array('deploy', $permissions)"></x-forms.checkbox>
-                    <x-forms.checkbox label="read" domValue="read" wire:model.live="permissions" domValue="read"
+                    @if ($canUseDeployPermissions)
+                        <x-forms.checkbox label="deploy" wire:model.live="permissions" domValue="deploy"
+                            helper="Can trigger deploy webhooks." :checked="in_array('deploy', $permissions)"></x-forms.checkbox>
+                    @else
+                        <x-forms.checkbox label="deploy (admin/owner only)" disabled domValue="deploy"
+                            helper="Deploy access requires admin or owner role" :checked="false"></x-forms.checkbox>
+                    @endif
+                    <x-forms.checkbox label="read" wire:model.live="permissions" domValue="read"
                         :checked="in_array('read', $permissions)"></x-forms.checkbox>
-                    <x-forms.checkbox label="read:sensitive" wire:model.live="permissions" domValue="read:sensitive"
-                        helper="Responses will include secrets, logs, passwords, and compose file contents."
-                        :checked="in_array('read:sensitive', $permissions)"></x-forms.checkbox>
+                    @if ($canUseSensitivePermissions)
+                        <x-forms.checkbox label="read:sensitive" wire:model.live="permissions" domValue="read:sensitive"
+                            helper="Responses will include secrets, logs, passwords, and compose file contents."
+                            :checked="in_array('read:sensitive', $permissions)"></x-forms.checkbox>
+                    @else
+                        <x-forms.checkbox label="read:sensitive (admin/owner only)" disabled domValue="read:sensitive"
+                            helper="Read:sensitive access requires admin or owner role" :checked="false"></x-forms.checkbox>
+                    @endif
                 @endif
             </div>
             @if (in_array('root', $permissions))
@@ -70,13 +83,36 @@
         </form>
     @endcan
     @if (session()->has('token'))
-        <div class="py-4 font-bold dark:text-warning">Please copy this token now. For your security, it won't be shown
-            again.
+        <div class="p-4 my-4 border rounded dark:border-coolgray-200 dark:bg-coolgray-100">
+            <div class="pb-2 font-bold dark:text-warning">Please copy this token now. For your security, it won't
+                be shown again.</div>
+            <div class="relative" x-data="{ copied: false, isSecure: window.isSecureContext }">
+                <input type="text" value="{{ session('token') }}" readonly
+                    class="input !text-white !bg-coolgray-200 font-mono" />
+                <button x-show="isSecure"
+                    @click.prevent="copied = true; navigator.clipboard.writeText({{ Js::from(session('token')) }}); setTimeout(() => copied = false, 1000)"
+                    class="absolute right-2 top-1/2 -translate-y-1/2 p-1.5 text-gray-400 hover:text-gray-300 transition-colors"
+                    title="Copy to clipboard">
+                    <svg x-show="!copied" class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+                            d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
+                    </svg>
+                    <svg x-show="copied" class="w-5 h-5 text-green-500" fill="none" stroke="currentColor"
+                        viewBox="0 0 24 24">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+                            d="M5 13l4 4L19 7" />
+                    </svg>
+                </button>
+            </div>
         </div>
-        <div class="pb-4 font-bold dark:text-white"> {{ session('token') }}</div>
     @endif
-    <h3 class="py-4">Issued Tokens</h3>
-    <div class="flex flex-col">
+    <div x-data="{ search: '' }">
+        <div class="flex items-center justify-between py-4">
+            <h3>Issued Tokens</h3>
+            @if ($tokens->count() > 1)
+                <input type="text" x-model="search" placeholder="Filter tokens..." class="input w-64" />
+            @endif
+        </div>
         <div class="flex flex-col">
             <div class="overflow-x-auto">
                 <div class="inline-block min-w-full">
@@ -94,13 +130,17 @@
                             </thead>
                             <tbody>
                                 @forelse ($tokens as $token)
-                                    <tr wire:key="token-{{ $token->id }}">
+                                    <tr wire:key="token-{{ $token->id }}"
+                                        x-show="!search || {{ Js::from(strtolower($token->name).' '.strtolower(implode(' ', $token->abilities ?? []))) }}.includes(search.toLowerCase())">
                                         <td class="px-5 py-4 text-sm whitespace-nowrap">{{ $token->name }}</td>
                                         <td class="px-5 py-4 text-sm whitespace-nowrap">
                                             @if ($token->abilities)
-                                                <div class="flex gap-1">
+                                                <div class="flex gap-1.5 flex-wrap">
                                                     @foreach ($token->abilities as $ability)
-                                                        <div class="font-bold dark:text-white">{{ $ability }}</div>
+                                                        <span
+                                                            class="px-2 py-0.5 text-xs rounded-sm font-medium {{ $ability === 'root' ? 'bg-red-500/20 text-red-400' : ($ability === 'write' || $ability === 'write:sensitive' ? 'bg-amber-500/20 text-amber-400' : ($ability === 'deploy' ? 'bg-blue-500/20 text-blue-400' : 'bg-neutral-500/20 text-neutral-300')) }}">
+                                                            {{ $ability }}
+                                                        </span>
                                                     @endforeach
                                                 </div>
                                             @endif
diff --git a/resources/views/livewire/server/cloudflare-tunnel.blade.php b/resources/views/livewire/server/cloudflare-tunnel.blade.php
index 2ebac9d41..668fae8f1 100644
--- a/resources/views/livewire/server/cloudflare-tunnel.blade.php
+++ b/resources/views/livewire/server/cloudflare-tunnel.blade.php
@@ -71,6 +71,11 @@
                     </x-callout>
                 @endif
                 @if (!$isCloudflareTunnelsEnabled && $server->isFunctional())
+                    @cannot('update', $server)
+                        <x-callout type="danger" title="Insufficient Permissions" class="mb-4">
+                            You don't have permission to configure Cloudflare Tunnel for this server.
+                        </x-callout>
+                    @endcannot
                     <div class="flex  flex-col pb-2">
                         <h3>Automated </h3>
                         <a href="https://coolify.io/docs/knowledge-base/cloudflare/tunnels/server-ssh" target="_blank"
@@ -91,10 +96,6 @@
                                     helper="The SSH domain you configured in Cloudflare. Make sure there is no protocol like http(s):// so you provide a FQDN not a URL. <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/cloudflare/tunnels/server-ssh' target='_blank'>Documentation</a>" />
                                 <x-forms.button type="submit" isHighlighted>Continue</x-forms.button>
                             </form>
-                        @else
-                            <x-callout type="warning" title="Permission Required" class="mb-4">
-                                You don't have permission to configure Cloudflare Tunnel for this server.
-                            </x-callout>
                         @endcan
                     </div>
                     @script
@@ -121,10 +122,6 @@
                         ]" confirmationText="I manually configured Cloudflare Tunnel"
                         confirmationLabel="Please type the confirmation text to confirm that you manually configured Cloudflare Tunnel."
                         shortConfirmationLabel="Confirmation text" />
-                @else
-                    <x-callout type="warning" title="Permission Required" class="mb-4">
-                        You don't have permission to configure Cloudflare Tunnel for this server.
-                    </x-callout>
                 @endcan
             </div>
             @endif
diff --git a/resources/views/livewire/server/navbar.blade.php b/resources/views/livewire/server/navbar.blade.php
index ed7d59980..463ecef3b 100644
--- a/resources/views/livewire/server/navbar.blade.php
+++ b/resources/views/livewire/server/navbar.blade.php
@@ -78,7 +78,7 @@
                             @endif
                         </a>
             @endif
-            @if ($server->isFunctional() && !$server->isSwarm() && !$server->settings->is_build_server)
+            @if ($server->isFunctional() && !$server->isSwarm() && !$server->settings->is_build_server && auth()->user()?->can('viewSentinel', $server))
                         <a class="{{ request()->routeIs('server.sentinel') || request()->routeIs('server.sentinel.*') ? 'dark:text-white' : '' }} flex items-center gap-1" href="{{ route('server.sentinel', [
                     'server_uuid' => data_get($server, 'uuid'),
                 ]) }}" {{ wireNavigate() }}>
@@ -114,6 +114,7 @@
         <div class="order-first sm:order-last">
             <div>
                 @if ($server->proxySet())
+                    @can('manageProxy', $server)
                     @if ($proxyStatus === 'running')
                             <div class="flex gap-2">
                                 <div class="mt-1" wire:loading wire:target="loadProxyConfiguration">
@@ -178,6 +179,7 @@
                             Start Proxy
                         </button>
                     @endif
+                    @endcan
                 @endif
                 @script
                 <script>
diff --git a/resources/views/livewire/server/proxy.blade.php b/resources/views/livewire/server/proxy.blade.php
index 127f583d6..143149abb 100644
--- a/resources/views/livewire/server/proxy.blade.php
+++ b/resources/views/livewire/server/proxy.blade.php
@@ -174,7 +174,7 @@
                         </x-forms.button> --}}
                     </div>
                 @else
-                    <x-callout type="warning" title="Permission Required" class="mb-4">
+                    <x-callout type="danger" title="Insufficient Permissions" class="mb-4">
                         You don't have permission to configure proxy settings for this server.
                     </x-callout>
                 @endcan
diff --git a/resources/views/livewire/server/resources.blade.php b/resources/views/livewire/server/resources.blade.php
index 8610cd704..a13f88e83 100644
--- a/resources/views/livewire/server/resources.blade.php
+++ b/resources/views/livewire/server/resources.blade.php
@@ -134,22 +134,22 @@
                                                             {{ data_get($resource, 'State') }}
                                                         </td>
                                                         <td class="flex gap-2 px-5 py-4 text-sm whitespace-nowrap">
-                                                            @if (data_get($resource, 'State') === 'running')
-                                                                <x-forms.button
-                                                                    wire:click="restartUnmanaged('{{ data_get($resource, 'ID') }}')"
-                                                                    wire:key="{{ data_get($resource, 'ID') }}">Restart</x-forms.button>
-                                                                <x-forms.button isError
-                                                                    wire:click="stopUnmanaged('{{ data_get($resource, 'ID') }}')"
-                                                                    wire:key="{{ data_get($resource, 'ID') }}">Stop</x-forms.button>
-                                                            @elseif (data_get($resource, 'State') === 'exited')
-                                                                <x-forms.button
-                                                                    wire:click="startUnmanaged('{{ data_get($resource, 'ID') }}')"
-                                                                    wire:key="{{ data_get($resource, 'ID') }}">Start</x-forms.button>
-                                                            @elseif (data_get($resource, 'State') === 'restarting')
-                                                                <x-forms.button
-                                                                    wire:click="stopUnmanaged('{{ data_get($resource, 'ID') }}')"
-                                                                    wire:key="{{ data_get($resource, 'ID') }}">Stop</x-forms.button>
-                                                            @endif
+                                                                @if (data_get($resource, 'State') === 'running')
+                                                                    <x-forms.button canGate="update" :canResource="$server"
+                                                                        wire:click="restartUnmanaged('{{ data_get($resource, 'ID') }}')"
+                                                                        wire:key="{{ data_get($resource, 'ID') }}">Restart</x-forms.button>
+                                                                    <x-forms.button canGate="update" :canResource="$server" isError
+                                                                        wire:click="stopUnmanaged('{{ data_get($resource, 'ID') }}')"
+                                                                        wire:key="{{ data_get($resource, 'ID') }}">Stop</x-forms.button>
+                                                                @elseif (data_get($resource, 'State') === 'exited')
+                                                                    <x-forms.button canGate="update" :canResource="$server"
+                                                                        wire:click="startUnmanaged('{{ data_get($resource, 'ID') }}')"
+                                                                        wire:key="{{ data_get($resource, 'ID') }}">Start</x-forms.button>
+                                                                @elseif (data_get($resource, 'State') === 'restarting')
+                                                                    <x-forms.button canGate="update" :canResource="$server"
+                                                                        wire:click="stopUnmanaged('{{ data_get($resource, 'ID') }}')"
+                                                                        wire:key="{{ data_get($resource, 'ID') }}">Stop</x-forms.button>
+                                                                @endif
                                                         </td>
                                                     </tr>
                                                 @endforeach
diff --git a/resources/views/livewire/source/github/create.blade.php b/resources/views/livewire/source/github/create.blade.php
index 9d5189b43..eedb8809c 100644
--- a/resources/views/livewire/source/github/create.blade.php
+++ b/resources/views/livewire/source/github/create.blade.php
@@ -63,7 +63,7 @@
         </x-forms.button>
     </form>
 @else
-    <x-callout type="warning" title="Permission Required">
+    <x-callout type="danger" title="Insufficient Permissions">
         You don't have permission to create new GitHub Apps. Please contact your team administrator for access.
     </x-callout>
 @endcan
\ No newline at end of file
diff --git a/resources/views/livewire/storage/create.blade.php b/resources/views/livewire/storage/create.blade.php
index 78ac717a1..32aeda095 100644
--- a/resources/views/livewire/storage/create.blade.php
+++ b/resources/views/livewire/storage/create.blade.php
@@ -24,7 +24,7 @@
         </form>
     </div>
 @else
-    <x-callout type="warning" title="Permission Required">
+    <x-callout type="danger" title="Insufficient Permissions">
         You don't have permission to create new S3 storage configurations. Please contact your team administrator for
         access.
     </x-callout>
diff --git a/resources/views/livewire/storage/form.blade.php b/resources/views/livewire/storage/form.blade.php
index 3d9fd322b..36b4b8e88 100644
--- a/resources/views/livewire/storage/form.blade.php
+++ b/resources/views/livewire/storage/form.blade.php
@@ -10,10 +10,15 @@
             <x-forms.input canGate="update" :canResource="$storage" required label="Region" id="region" />
         </div>
         <div class="flex gap-2">
-            <x-forms.input canGate="update" :canResource="$storage" required type="password" label="Access Key"
-                id="key" />
-            <x-forms.input canGate="update" :canResource="$storage" required type="password" label="Secret Key"
-                id="secret" />
+            @if ($isPasswordHiddenForMember)
+                <x-forms.input label="Access Key" disabled value="Hidden (only admins can view)" />
+                <x-forms.input label="Secret Key" disabled value="Hidden (only admins can view)" />
+            @else
+                <x-forms.input canGate="update" :canResource="$storage" required type="password" label="Access Key"
+                    id="key" />
+                <x-forms.input canGate="update" :canResource="$storage" required type="password" label="Secret Key"
+                    id="secret" />
+            @endif
         </div>
         @can('validateConnection', $storage)
             <x-forms.button class="mt-4" isHighlighted wire:click="testConnection">
diff --git a/resources/views/livewire/subscription/index.blade.php b/resources/views/livewire/subscription/index.blade.php
index c78af77f9..dc18f54d4 100644
--- a/resources/views/livewire/subscription/index.blade.php
+++ b/resources/views/livewire/subscription/index.blade.php
@@ -54,7 +54,7 @@
             <div class="flex gap-2">
                 <h1>Subscription</h1>
             </div>
-            <x-callout type="warning" title="Permission Required">
+            <x-callout type="danger" title="Insufficient Permissions">
                 You are not an admin so you cannot manage your Team's subscription. If this does not make sense, please
                 <span class="underline cursor-pointer dark:text-white" wire:click="help">contact us</span>.
             </x-callout>
diff --git a/resources/views/livewire/upgrade.blade.php b/resources/views/livewire/upgrade.blade.php
index be2a7618a..2b986a33e 100644
--- a/resources/views/livewire/upgrade.blade.php
+++ b/resources/views/livewire/upgrade.blade.php
@@ -13,7 +13,7 @@
                     <path stroke="none" d="M0 0h24v24H0z" fill="none" />
                     <path d="M19.5 13.572l-7.5 7.428l-7.5 -7.428m0 0a5 5 0 1 1 7.5 -6.566a5 5 0 1 1 7.5 6.572" />
                 </svg>
-                <span class="text-left menu-item-label" :class="collapsed && 'lg:hidden'">In progress</span>
+                <span class="text-left menu-item-label sidebar-collapsed-label">In progress</span>
             </button>
             <button title="Upgrade" aria-label="Upgrade" class="menu-item cursor-pointer" @click="modalOpen=true" x-show="!showProgress">
                 <svg xmlns="http://www.w3.org/2000/svg" class="text-pink-500 transition-colors menu-item-icon hover:text-pink-300"
@@ -25,7 +25,7 @@
                     <path d="M9 21h6" />
                     <path d="M9 18h6" />
                 </svg>
-                <span class="text-left menu-item-label" :class="collapsed && 'lg:hidden'">Upgrade</span>
+                <span class="text-left menu-item-label sidebar-collapsed-label">Upgrade</span>
             </button>
             <template x-teleport="body">
                 <div x-show="modalOpen"
diff --git a/tests/Feature/ApplicationHealthCheckApiTest.php b/tests/Feature/Api/ApplicationHealthCheckApiTest.php
similarity index 100%
rename from tests/Feature/ApplicationHealthCheckApiTest.php
rename to tests/Feature/Api/ApplicationHealthCheckApiTest.php
diff --git a/tests/Feature/CloudProviderTokenApiTest.php b/tests/Feature/Api/CloudProviderTokenApiTest.php
similarity index 92%
rename from tests/Feature/CloudProviderTokenApiTest.php
rename to tests/Feature/Api/CloudProviderTokenApiTest.php
index 0221faeac..42b2d0972 100644
--- a/tests/Feature/CloudProviderTokenApiTest.php
+++ b/tests/Feature/Api/CloudProviderTokenApiTest.php
@@ -6,11 +6,17 @@ use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Once;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+    InstanceSettings::query()->whereKey(0)->delete();
+    $settings = new InstanceSettings(['is_api_enabled' => true]);
+    $settings->id = 0;
+    $settings->save();
+    Once::flush();
 
     // Create a team with owner
     $this->team = Team::factory()->create();
@@ -511,4 +517,33 @@ describe('POST /api/v1/cloud-tokens/{uuid}/validate', function () {
         $response->assertStatus(200);
         $response->assertJson(['valid' => true, 'message' => 'Token is valid.']);
     });
+
+    test('writes an audit log entry when validating a stored token', function () {
+        $token = CloudProviderToken::factory()->create([
+            'team_id' => $this->team->id,
+            'provider' => 'hetzner',
+            'name' => 'Audit Token',
+        ]);
+
+        Http::fake([
+            'https://api.hetzner.cloud/v1/servers' => Http::response([], 200),
+        ]);
+
+        $auditChannel = Mockery::mock();
+        $auditChannel->shouldReceive('info')
+            ->once()
+            ->with('api.cloud_token.validated', Mockery::on(function (array $context) use ($token) {
+                return $context['cloud_token_uuid'] === $token->uuid
+                    && $context['provider'] === 'hetzner'
+                    && $context['valid'] === true;
+            }));
+
+        Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+
+        $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/cloud-tokens/{$token->uuid}/validate")
+            ->assertOk();
+    });
 });
diff --git a/tests/Feature/Api/DatabaseBackupCreationApiTest.php b/tests/Feature/Api/DatabaseBackupCreationApiTest.php
new file mode 100644
index 000000000..8882fec39
--- /dev/null
+++ b/tests/Feature/Api/DatabaseBackupCreationApiTest.php
@@ -0,0 +1,277 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+
+    $this->token = $this->user->createToken('test-token', ['*']);
+    $this->bearerToken = $this->token->plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->s3Storage = S3Storage::create([
+        'name' => 'test-s3',
+        'region' => 'us-east-1',
+        'key' => 'test-key',
+        'secret' => 'test-secret',
+        'bucket' => 'test-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $this->team->id,
+        'is_usable' => true,
+    ]);
+});
+
+function backupHeaders(): array
+{
+    return [
+        'Authorization' => 'Bearer '.test()->bearerToken,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+describe('POST /api/v1/databases/{uuid}/backups', function () {
+    test('creates backup configuration with valid frequency', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => 'daily',
+            ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid', 'message']);
+        $response->assertJson(['message' => 'Backup configuration created successfully.']);
+    });
+
+    test('creates backup with valid cron expression', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => '0 2 * * *',
+            ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid', 'message']);
+    });
+
+    test('accepts all predefined frequency values', function () {
+        $frequencies = ['every_minute', 'hourly', 'daily', 'weekly', 'monthly', 'yearly'];
+
+        foreach ($frequencies as $frequency) {
+            $response = $this->withHeaders(backupHeaders())
+                ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                    'frequency' => $frequency,
+                ]);
+
+            $response->assertStatus(201, "Expected 201 for frequency '{$frequency}', got {$response->status()}");
+        }
+    });
+
+    test('validates frequency is required', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'enabled' => true,
+            ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors(['frequency']);
+    });
+
+    test('rejects invalid frequency format', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => 'invalid-frequency',
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('validates s3_storage_uuid required when save_s3 is true', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => 'daily',
+                'save_s3' => true,
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('validates retention fields are integers with minimum 0', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => 'daily',
+                'database_backup_retention_amount_locally' => -1,
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('rejects extra fields not in allowed list', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => 'daily',
+                'invalid_field' => 'invalid_value',
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('rejects request without authentication', function () {
+        $response = $this->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+            'frequency' => 'daily',
+        ]);
+
+        $response->assertStatus(401);
+    });
+
+    test('returns 404 for non-existent database uuid', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson('/api/v1/databases/non-existent-uuid/backups', [
+                'frequency' => 'daily',
+            ]);
+
+        $response->assertStatus(404);
+        $response->assertJson(['message' => 'Database not found.']);
+    });
+
+    test('creates backup with s3 storage via API token', function () {
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => '0 2 * * 0',
+                'save_s3' => true,
+                's3_storage_uuid' => $this->s3Storage->uuid,
+                'enabled' => true,
+            ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid', 'message']);
+
+        $backup = ScheduledDatabaseBackup::where('uuid', $response->json('uuid'))->first();
+        expect($backup)->not->toBeNull();
+        expect($backup->s3_storage_id)->toBe($this->s3Storage->id);
+        expect($backup->save_s3)->toBeTrue();
+        expect($backup->team_id)->toBe($this->team->id);
+    });
+
+    test('rejects s3_storage_uuid from another team', function () {
+        $otherTeam = Team::factory()->create();
+        $otherS3 = S3Storage::create([
+            'name' => 'other-s3',
+            'region' => 'us-east-1',
+            'key' => 'other-key',
+            'secret' => 'other-secret',
+            'bucket' => 'other-bucket',
+            'endpoint' => 'https://s3.example.com',
+            'team_id' => $otherTeam->id,
+            'is_usable' => true,
+        ]);
+
+        $response = $this->withHeaders(backupHeaders())
+            ->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+                'frequency' => '0 2 * * 0',
+                'save_s3' => true,
+                's3_storage_uuid' => $otherS3->uuid,
+            ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors(['s3_storage_uuid']);
+    });
+});
+
+describe('PATCH /api/v1/databases/{uuid}/backups/{scheduled_backup_uuid}', function () {
+    test('updates backup to use s3 storage via API token', function () {
+        $backup = ScheduledDatabaseBackup::create([
+            'frequency' => 'daily',
+            'enabled' => true,
+            'database_id' => $this->database->id,
+            'database_type' => $this->database->getMorphClass(),
+            'team_id' => $this->team->id,
+        ]);
+
+        $response = $this->withHeaders(backupHeaders())
+            ->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
+                'save_s3' => true,
+                's3_storage_uuid' => $this->s3Storage->uuid,
+            ]);
+
+        $response->assertStatus(200);
+        $backup->refresh();
+        expect($backup->s3_storage_id)->toBe($this->s3Storage->id);
+        expect($backup->save_s3)->toBeTrue();
+    });
+
+    test('rejects s3_storage_uuid from another team on update', function () {
+        $otherTeam = Team::factory()->create();
+        $otherS3 = S3Storage::create([
+            'name' => 'other-s3',
+            'region' => 'us-east-1',
+            'key' => 'other-key',
+            'secret' => 'other-secret',
+            'bucket' => 'other-bucket',
+            'endpoint' => 'https://s3.example.com',
+            'team_id' => $otherTeam->id,
+            'is_usable' => true,
+        ]);
+
+        $backup = ScheduledDatabaseBackup::create([
+            'frequency' => 'daily',
+            'enabled' => true,
+            'database_id' => $this->database->id,
+            'database_type' => $this->database->getMorphClass(),
+            'team_id' => $this->team->id,
+        ]);
+
+        $response = $this->withHeaders(backupHeaders())
+            ->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
+                'save_s3' => true,
+                's3_storage_uuid' => $otherS3->uuid,
+            ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors(['s3_storage_uuid']);
+    });
+});
diff --git a/tests/Feature/DeploymentCancellationApiTest.php b/tests/Feature/Api/DeploymentCancellationApiTest.php
similarity index 73%
rename from tests/Feature/DeploymentCancellationApiTest.php
rename to tests/Feature/Api/DeploymentCancellationApiTest.php
index eee689e13..046af059a 100644
--- a/tests/Feature/DeploymentCancellationApiTest.php
+++ b/tests/Feature/Api/DeploymentCancellationApiTest.php
@@ -2,6 +2,7 @@
 
 use App\Enums\ApplicationDeploymentStatus;
 use App\Models\ApplicationDeploymentQueue;
+use App\Models\InstanceSettings;
 use App\Models\Server;
 use App\Models\Team;
 use App\Models\User;
@@ -10,13 +11,17 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
     // Create a team with owner
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);
 
+    session(['currentTeam' => $this->team]);
+
     // Create an API token for the user
-    $this->token = $this->user->createToken('test-token', ['*'], $this->team->id);
+    $this->token = $this->user->createToken('test-token', ['*']);
     $this->bearerToken = $this->token->plainTextToken;
 
     // Create a server for the team
@@ -76,7 +81,7 @@ describe('POST /api/v1/deployments/{uuid}/cancel', function () {
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
         $response->assertStatus(400);
-        $response->assertJsonFragment(['Deployment cannot be cancelled']);
+        expect($response->json('message'))->toContain('Deployment cannot be cancelled');
     });
 
     test('returns 400 when deployment is already failed', function () {
@@ -93,7 +98,7 @@ describe('POST /api/v1/deployments/{uuid}/cancel', function () {
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
         $response->assertStatus(400);
-        $response->assertJsonFragment(['Deployment cannot be cancelled']);
+        expect($response->json('message'))->toContain('Deployment cannot be cancelled');
     });
 
     test('returns 400 when deployment is already cancelled', function () {
@@ -110,10 +115,10 @@ describe('POST /api/v1/deployments/{uuid}/cancel', function () {
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
         $response->assertStatus(400);
-        $response->assertJsonFragment(['Deployment cannot be cancelled']);
+        expect($response->json('message'))->toContain('Deployment cannot be cancelled');
     });
 
-    test('successfully cancels queued deployment', function () {
+    test('cancels queued deployment and updates status in database', function () {
         $deployment = ApplicationDeploymentQueue::create([
             'deployment_uuid' => 'queued-deployment-uuid',
             'application_id' => 1,
@@ -121,20 +126,17 @@ describe('POST /api/v1/deployments/{uuid}/cancel', function () {
             'status' => ApplicationDeploymentStatus::QUEUED->value,
         ]);
 
-        $response = $this->withHeaders([
+        $this->withHeaders([
             'Authorization' => 'Bearer '.$this->bearerToken,
             'Content-Type' => 'application/json',
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
-        // Expect success (200) or 500 if server connection fails (which is expected in test environment)
-        expect($response->status())->toBeIn([200, 500]);
-
-        // Verify deployment status was updated to cancelled
+        // The controller updates status before SSH calls, so DB state is always correct
         $deployment->refresh();
         expect($deployment->status)->toBe(ApplicationDeploymentStatus::CANCELLED_BY_USER->value);
     });
 
-    test('successfully cancels in-progress deployment', function () {
+    test('cancels in-progress deployment and updates status in database', function () {
         $deployment = ApplicationDeploymentQueue::create([
             'deployment_uuid' => 'in-progress-deployment-uuid',
             'application_id' => 1,
@@ -142,42 +144,13 @@ describe('POST /api/v1/deployments/{uuid}/cancel', function () {
             'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
         ]);
 
-        $response = $this->withHeaders([
+        $this->withHeaders([
             'Authorization' => 'Bearer '.$this->bearerToken,
             'Content-Type' => 'application/json',
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
-        // Expect success (200) or 500 if server connection fails (which is expected in test environment)
-        expect($response->status())->toBeIn([200, 500]);
-
-        // Verify deployment status was updated to cancelled
+        // The controller updates status before SSH calls, so DB state is always correct
         $deployment->refresh();
         expect($deployment->status)->toBe(ApplicationDeploymentStatus::CANCELLED_BY_USER->value);
     });
-
-    test('returns correct response structure on success', function () {
-        $deployment = ApplicationDeploymentQueue::create([
-            'deployment_uuid' => 'success-deployment-uuid',
-            'application_id' => 1,
-            'server_id' => $this->server->id,
-            'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
-        ]);
-
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
-
-        if ($response->status() === 200) {
-            $response->assertJsonStructure([
-                'message',
-                'deployment_uuid',
-                'status',
-            ]);
-            $response->assertJson([
-                'deployment_uuid' => $deployment->deployment_uuid,
-                'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
-            ]);
-        }
-    });
 });
diff --git a/tests/Feature/DomainsByServerApiTest.php b/tests/Feature/Api/DomainsByServerApiTest.php
similarity index 95%
rename from tests/Feature/DomainsByServerApiTest.php
rename to tests/Feature/Api/DomainsByServerApiTest.php
index ea799275b..c14e538a7 100644
--- a/tests/Feature/DomainsByServerApiTest.php
+++ b/tests/Feature/Api/DomainsByServerApiTest.php
@@ -26,7 +26,7 @@ beforeEach(function () {
     $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
 });
 
-function authHeaders(): array
+function domainApiAuthHeaders(): array
 {
     return [
         'Authorization' => 'Bearer '.test()->bearerToken,
@@ -41,7 +41,7 @@ test('returns domains for own team application via uuid query param', function (
         'destination_type' => $this->destination->getMorphClass(),
     ]);
 
-    $response = $this->withHeaders(authHeaders())
+    $response = $this->withHeaders(domainApiAuthHeaders())
         ->getJson("/api/v1/servers/{$this->server->uuid}/domains?uuid={$application->uuid}");
 
     $response->assertOk();
@@ -65,7 +65,7 @@ test('returns 404 when application uuid belongs to another team', function () {
         'destination_type' => $otherDestination->getMorphClass(),
     ]);
 
-    $response = $this->withHeaders(authHeaders())
+    $response = $this->withHeaders(domainApiAuthHeaders())
         ->getJson("/api/v1/servers/{$this->server->uuid}/domains?uuid={$otherApplication->uuid}");
 
     $response->assertNotFound();
@@ -73,7 +73,7 @@ test('returns 404 when application uuid belongs to another team', function () {
 });
 
 test('returns 404 for nonexistent application uuid', function () {
-    $response = $this->withHeaders(authHeaders())
+    $response = $this->withHeaders(domainApiAuthHeaders())
         ->getJson("/api/v1/servers/{$this->server->uuid}/domains?uuid=nonexistent-uuid");
 
     $response->assertNotFound();
diff --git a/tests/Feature/EnvironmentVariableUpdateApiTest.php b/tests/Feature/Api/EnvironmentVariableUpdateApiTest.php
similarity index 100%
rename from tests/Feature/EnvironmentVariableUpdateApiTest.php
rename to tests/Feature/Api/EnvironmentVariableUpdateApiTest.php
diff --git a/tests/Feature/GithubAppsListApiTest.php b/tests/Feature/Api/GithubAppsListApiTest.php
similarity index 100%
rename from tests/Feature/GithubAppsListApiTest.php
rename to tests/Feature/Api/GithubAppsListApiTest.php
diff --git a/tests/Feature/HetznerApiTest.php b/tests/Feature/Api/HetznerApiTest.php
similarity index 94%
rename from tests/Feature/HetznerApiTest.php
rename to tests/Feature/Api/HetznerApiTest.php
index b5950f9fc..728b99d0e 100644
--- a/tests/Feature/HetznerApiTest.php
+++ b/tests/Feature/Api/HetznerApiTest.php
@@ -1,15 +1,23 @@
 <?php
 
 use App\Models\CloudProviderToken;
+use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Once;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    InstanceSettings::query()->whereKey(0)->delete();
+    $settings = new InstanceSettings(['is_api_enabled' => true]);
+    $settings->id = 0;
+    $settings->save();
+    Once::flush();
+
     // Create a team with owner
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
@@ -73,6 +81,27 @@ describe('GET /api/v1/hetzner/locations', function () {
 
         $response->assertStatus(404);
     });
+
+    test('member read token cannot use a stored cloud provider token', function () {
+        $member = User::factory()->create();
+        $this->team->members()->attach($member->id, ['role' => 'member']);
+        session(['currentTeam' => $this->team]);
+        $memberToken = $member->createToken('member-read', ['read'])->plainTextToken;
+
+        Http::fake([
+            'https://api.hetzner.cloud/v1/locations*' => Http::response([
+                'locations' => [['id' => 1, 'name' => 'nbg1']],
+            ], 200),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$memberToken,
+            'Content-Type' => 'application/json',
+        ])->getJson('/api/v1/hetzner/locations?cloud_provider_token_id='.$this->hetznerToken->uuid);
+
+        $response->assertForbidden();
+        Http::assertNothingSent();
+    });
 });
 
 describe('GET /api/v1/hetzner/server-types', function () {
diff --git a/tests/Feature/ScheduledTaskApiTest.php b/tests/Feature/Api/ScheduledTaskApiTest.php
similarity index 100%
rename from tests/Feature/ScheduledTaskApiTest.php
rename to tests/Feature/Api/ScheduledTaskApiTest.php
diff --git a/tests/Feature/ApplicationBuildpackCleanupTest.php b/tests/Feature/Application/ApplicationBuildpackCleanupTest.php
similarity index 100%
rename from tests/Feature/ApplicationBuildpackCleanupTest.php
rename to tests/Feature/Application/ApplicationBuildpackCleanupTest.php
diff --git a/tests/Feature/BuildpackSwitchCleanupTest.php b/tests/Feature/Application/BuildpackSwitchCleanupTest.php
similarity index 100%
rename from tests/Feature/BuildpackSwitchCleanupTest.php
rename to tests/Feature/Application/BuildpackSwitchCleanupTest.php
diff --git a/tests/Feature/GithubSourceChangeTest.php b/tests/Feature/Application/GithubSourceChangeTest.php
similarity index 100%
rename from tests/Feature/GithubSourceChangeTest.php
rename to tests/Feature/Application/GithubSourceChangeTest.php
diff --git a/tests/Feature/GithubSourceCreateTest.php b/tests/Feature/Application/GithubSourceCreateTest.php
similarity index 100%
rename from tests/Feature/GithubSourceCreateTest.php
rename to tests/Feature/Application/GithubSourceCreateTest.php
diff --git a/tests/Feature/DeletesUserSessionsTest.php b/tests/Feature/Auth/DeletesUserSessionsTest.php
similarity index 100%
rename from tests/Feature/DeletesUserSessionsTest.php
rename to tests/Feature/Auth/DeletesUserSessionsTest.php
diff --git a/tests/Feature/Auth/LoginRateLimitIPTest.php b/tests/Feature/Auth/LoginRateLimitIPTest.php
new file mode 100644
index 000000000..e1b85ae5c
--- /dev/null
+++ b/tests/Feature/Auth/LoginRateLimitIPTest.php
@@ -0,0 +1,68 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\RateLimiter;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+    RateLimiter::clear('login');
+
+    $this->user = User::factory()->create([
+        'email' => 'test@example.com',
+        'password' => bcrypt('password'),
+    ]);
+});
+
+test('login is rate limited after 5 failed attempts from same IP', function () {
+    $email = 'test@example.com';
+
+    // First 5 attempts should be accepted (302 redirect back with error, not 429)
+    for ($i = 1; $i <= 5; $i++) {
+        $response = $this->post('/login', [
+            'email' => $email,
+            'password' => 'wrong-password',
+        ]);
+
+        expect($response->status())->toBe(302, "Attempt {$i} should redirect (302), got {$response->status()}");
+    }
+
+    // 6th attempt from same IP should be throttled
+    $response = $this->post('/login', [
+        'email' => $email,
+        'password' => 'wrong-password',
+    ]);
+
+    expect($response->status())->toBe(429, 'Expected 429 Too Many Requests after exceeding rate limit');
+});
+
+test('rate limit is scoped per email and IP combination', function () {
+    // Exhaust rate limit for first email
+    for ($i = 1; $i <= 5; $i++) {
+        $this->post('/login', [
+            'email' => 'test@example.com',
+            'password' => 'wrong-password',
+        ]);
+    }
+
+    // Different email from same IP should still work (different composite key)
+    $response = $this->post('/login', [
+        'email' => 'other@example.com',
+        'password' => 'wrong-password',
+    ]);
+
+    expect($response->status())->toBe(302, 'Different email should not be rate limited');
+});
+
+test('successful login is still possible within rate limit', function () {
+    $response = $this->post('/login', [
+        'email' => 'test@example.com',
+        'password' => 'password',
+    ]);
+
+    $response->assertRedirect();
+    expect($response->status())->not->toBe(429);
+});
diff --git a/tests/Feature/TwoFactorChallengeAccessTest.php b/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
similarity index 100%
rename from tests/Feature/TwoFactorChallengeAccessTest.php
rename to tests/Feature/Auth/TwoFactorChallengeAccessTest.php
diff --git a/tests/Feature/Authorization/ApiAuthorizationTest.php b/tests/Feature/Authorization/ApiAuthorizationTest.php
new file mode 100644
index 000000000..66a6900a3
--- /dev/null
+++ b/tests/Feature/Authorization/ApiAuthorizationTest.php
@@ -0,0 +1,218 @@
+<?php
+
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0], ['is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    // Create real tokens with team_id (createToken reads from session)
+    session(['currentTeam' => $this->team]);
+    $this->adminRootToken = $this->admin->createToken('admin-root', ['root']);
+    $this->adminReadToken = $this->admin->createToken('admin-read', ['read']);
+    $this->memberRootToken = $this->member->createToken('member-root', ['root']);
+});
+
+// --- Unauthenticated Access ---
+
+test('unauthenticated request to api returns 401', function () {
+    $this->getJson('/api/v1/projects')->assertStatus(401);
+});
+
+// --- Admin with root token ---
+
+test('admin with root token can list projects', function () {
+    $this->withToken($this->adminRootToken->plainTextToken)
+        ->getJson('/api/v1/projects')
+        ->assertSuccessful();
+});
+
+test('admin with root token can view project', function () {
+    $this->withToken($this->adminRootToken->plainTextToken)
+        ->getJson("/api/v1/projects/{$this->project->uuid}")
+        ->assertSuccessful();
+});
+
+test('admin with root token can view application', function () {
+    $this->withToken($this->adminRootToken->plainTextToken)
+        ->getJson("/api/v1/applications/{$this->application->uuid}")
+        ->assertSuccessful();
+});
+
+test('admin with root token can view server', function () {
+    $this->withToken($this->adminRootToken->plainTextToken)
+        ->getJson("/api/v1/servers/{$this->server->uuid}")
+        ->assertSuccessful();
+});
+
+test('admin with root token can view database', function () {
+    $this->withToken($this->adminRootToken->plainTextToken)
+        ->getJson("/api/v1/databases/{$this->database->uuid}")
+        ->assertSuccessful();
+});
+
+// --- Member with root token (policy should deny mutations) ---
+
+test('member with root token is blocked by middleware', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->getJson("/api/v1/projects/{$this->project->uuid}")
+        ->assertStatus(403);
+});
+
+test('member with root token cannot delete project', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->deleteJson("/api/v1/projects/{$this->project->uuid}")
+        ->assertStatus(403);
+});
+
+test('member with root token cannot update application', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'name' => 'New Name',
+        ])
+        ->assertStatus(403);
+});
+
+test('member with root token cannot delete application', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->deleteJson("/api/v1/applications/{$this->application->uuid}")
+        ->assertStatus(403);
+});
+
+test('member with root token cannot delete server', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->deleteJson("/api/v1/servers/{$this->server->uuid}")
+        ->assertStatus(403);
+});
+
+test('member with root token cannot update server', function () {
+    $this->withToken($this->memberRootToken->plainTextToken)
+        ->patchJson("/api/v1/servers/{$this->server->uuid}", [
+            'name' => 'New Server Name',
+        ])
+        ->assertStatus(403);
+});
+
+// --- Token ability checks ---
+
+test('read-only token cannot create project', function () {
+    $this->withToken($this->adminReadToken->plainTextToken)
+        ->postJson('/api/v1/projects', [
+            'name' => 'New Project',
+        ])
+        ->assertStatus(403);
+});
+
+test('read-only token cannot delete application', function () {
+    $this->withToken($this->adminReadToken->plainTextToken)
+        ->deleteJson("/api/v1/applications/{$this->application->uuid}")
+        ->assertStatus(403);
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot view project via api', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+    session(['currentTeam' => $otherTeam]);
+    $otherToken = $otherUser->createToken('other-root', ['root']);
+
+    $this->withToken($otherToken->plainTextToken)
+        ->getJson("/api/v1/projects/{$this->project->uuid}")
+        ->assertStatus(404);
+});
+
+test('user from different team cannot view application via api', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+    session(['currentTeam' => $otherTeam]);
+    $otherToken = $otherUser->createToken('other-root', ['root']);
+
+    $this->withToken($otherToken->plainTextToken)
+        ->getJson("/api/v1/applications/{$this->application->uuid}")
+        ->assertStatus(404);
+});
+
+test('user from different team cannot view server via api', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+    session(['currentTeam' => $otherTeam]);
+    $otherToken = $otherUser->createToken('other-root', ['root']);
+
+    $this->withToken($otherToken->plainTextToken)
+        ->getJson("/api/v1/servers/{$this->server->uuid}")
+        ->assertStatus(404);
+});
diff --git a/tests/Feature/ApiTokenPermissionTest.php b/tests/Feature/Authorization/ApiTokenPermissionTest.php
similarity index 96%
rename from tests/Feature/ApiTokenPermissionTest.php
rename to tests/Feature/Authorization/ApiTokenPermissionTest.php
index f1782de2a..7cbd77791 100644
--- a/tests/Feature/ApiTokenPermissionTest.php
+++ b/tests/Feature/Authorization/ApiTokenPermissionTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Models\InstanceSettings;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -7,6 +8,8 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0], ['is_api_enabled' => true]);
+
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);
diff --git a/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php b/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
new file mode 100644
index 000000000..2c3aa123f
--- /dev/null
+++ b/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
@@ -0,0 +1,243 @@
+<?php
+
+use App\Livewire\Project\Application\Advanced as ApplicationAdvanced;
+use App\Livewire\Project\Application\Heading as ApplicationHeading;
+use App\Livewire\Project\Application\Rollback as ApplicationRollback;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+});
+
+// --- Application Policy: view ---
+
+test('admin can view application', function () {
+    expect($this->admin->can('view', $this->application))->toBeTrue();
+});
+
+test('member can view application', function () {
+    expect($this->member->can('view', $this->application))->toBeTrue();
+});
+
+// --- Application Policy: update ---
+
+test('admin can update application', function () {
+    expect($this->admin->can('update', $this->application))->toBeTrue();
+});
+
+test('member cannot update application', function () {
+    expect($this->member->can('update', $this->application))->toBeFalse();
+});
+
+// --- Application Policy: deploy ---
+
+test('admin can deploy application', function () {
+    expect($this->admin->can('deploy', $this->application))->toBeTrue();
+});
+
+test('member cannot deploy application', function () {
+    expect($this->member->can('deploy', $this->application))->toBeFalse();
+});
+
+// --- Application Policy: delete ---
+
+test('admin can delete application', function () {
+    expect($this->admin->can('delete', $this->application))->toBeTrue();
+});
+
+test('member cannot delete application', function () {
+    expect($this->member->can('delete', $this->application))->toBeFalse();
+});
+
+// --- Application Policy: manageEnvironment ---
+
+test('admin can manage application environment', function () {
+    expect($this->admin->can('manageEnvironment', $this->application))->toBeTrue();
+});
+
+test('member cannot manage application environment', function () {
+    expect($this->member->can('manageEnvironment', $this->application))->toBeFalse();
+});
+
+// --- Application Heading Livewire actions ---
+
+test('member cannot call deploy on application heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('deploy')
+        ->assertDispatched('error');
+});
+
+test('member cannot call restart on application heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('restart')
+        ->assertDispatched('error');
+});
+
+test('member cannot call stop on application heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('stop')
+        ->assertDispatched('error');
+});
+
+test('member cannot call force deploy on application heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('force_deploy_without_cache')
+        ->assertDispatched('error');
+});
+
+// --- Application General policy (Livewire mount requires full app data) ---
+
+test('member cannot update application general settings', function () {
+    expect($this->member->can('update', $this->application))->toBeFalse();
+});
+
+// --- Application Advanced Livewire actions ---
+
+test('member cannot save application advanced settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationAdvanced::class, ['application' => $this->application])
+        ->call('instantSave')
+        ->assertDispatched('error');
+});
+
+test('member cannot submit application advanced settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationAdvanced::class, ['application' => $this->application])
+        ->call('submit')
+        ->assertDispatched('error');
+});
+
+// --- Application Rollback Livewire actions ---
+
+test('member cannot save rollback settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationRollback::class, ['application' => $this->application])
+        ->call('saveSettings')
+        ->assertDispatched('error');
+});
+
+test('member cannot rollback image', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationRollback::class, ['application' => $this->application])
+        ->call('rollbackImage', 'test-image:latest')
+        ->assertForbidden();
+});
+
+// --- Application Heading visibility ---
+
+test('member does not see terminal link for application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->assertDontSee('Terminal');
+});
+
+test('admin sees terminal link for application', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->assertSee('Terminal');
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot view application', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('view', $this->application))->toBeFalse();
+});
+
+test('user from different team cannot update application', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('update', $this->application))->toBeFalse();
+});
diff --git a/tests/Feature/Authorization/CloudProviderAuthorizationTest.php b/tests/Feature/Authorization/CloudProviderAuthorizationTest.php
new file mode 100644
index 000000000..04c8d030c
--- /dev/null
+++ b/tests/Feature/Authorization/CloudProviderAuthorizationTest.php
@@ -0,0 +1,170 @@
+<?php
+
+use App\Models\CloudInitScript;
+use App\Models\CloudProviderToken;
+use App\Models\InstanceSettings;
+use App\Models\PersonalAccessToken;
+use App\Models\PrivateKey;
+use App\Models\Team;
+use App\Models\User;
+use App\Policies\CloudInitScriptPolicy;
+use App\Policies\CloudProviderTokenPolicy;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    DB::table('private_keys')->insert([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Team SSH Key',
+        'description' => 'Key for testing',
+        'private_key' => 'test-key-content',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->privateKey = PrivateKey::where('team_id', $this->team->id)->first();
+});
+
+// --- Private Key Policy ---
+
+test('admin can create private key', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', PrivateKey::class))->toBeTrue();
+});
+
+test('member cannot create private key', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', PrivateKey::class))->toBeFalse();
+});
+
+test('admin can view private key', function () {
+    expect($this->admin->can('view', $this->privateKey))->toBeTrue();
+});
+
+test('member can view own team private key', function () {
+    expect($this->member->can('view', $this->privateKey))->toBeTrue();
+});
+
+test('admin can update private key', function () {
+    expect($this->admin->can('update', $this->privateKey))->toBeTrue();
+});
+
+test('member cannot update private key', function () {
+    expect($this->member->can('update', $this->privateKey))->toBeFalse();
+});
+
+test('admin can delete private key', function () {
+    expect($this->admin->can('delete', $this->privateKey))->toBeTrue();
+});
+
+test('member cannot delete private key', function () {
+    expect($this->member->can('delete', $this->privateKey))->toBeFalse();
+});
+
+test('user from different team cannot view private key', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('view', $this->privateKey))->toBeFalse();
+});
+
+// --- Cloud Provider Token Policy ---
+
+test('admin can create cloud provider token', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', CloudProviderToken::class))->toBeTrue();
+});
+
+test('member cannot create cloud provider token', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', CloudProviderToken::class))->toBeFalse();
+});
+
+test('admin can view any cloud provider tokens', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('viewAny', CloudProviderToken::class))->toBeTrue();
+});
+
+// --- Cloud Init Script Policy ---
+
+test('admin can create cloud init script', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', CloudInitScript::class))->toBeTrue();
+});
+
+test('member cannot create cloud init script', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', CloudInitScript::class))->toBeFalse();
+});
+
+test('admin can view any cloud init scripts', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('viewAny', CloudInitScript::class))->toBeTrue();
+});
+
+test('cloud provider and cloud init policies are explicitly registered', function () {
+    expect(Gate::getPolicyFor(CloudProviderToken::class))->toBeInstanceOf(CloudProviderTokenPolicy::class)
+        ->and(Gate::getPolicyFor(CloudInitScript::class))->toBeInstanceOf(CloudInitScriptPolicy::class);
+});
+
+// --- Personal Access Token (API Token) Policy ---
+
+test('any user can create personal access token', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', PersonalAccessToken::class))->toBeTrue();
+});
+
+test('admin can use root permissions for api tokens', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('useRootPermissions', PersonalAccessToken::class))->toBeTrue();
+});
+
+test('member cannot use root permissions for api tokens', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('useRootPermissions', PersonalAccessToken::class))->toBeFalse();
+});
+
+test('member cannot use write permissions for api tokens', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('useWritePermissions', PersonalAccessToken::class))->toBeFalse();
+});
diff --git a/tests/Feature/Authorization/DashboardAuthorizationTest.php b/tests/Feature/Authorization/DashboardAuthorizationTest.php
new file mode 100644
index 000000000..26a39af0a
--- /dev/null
+++ b/tests/Feature/Authorization/DashboardAuthorizationTest.php
@@ -0,0 +1,97 @@
+<?php
+
+use App\Livewire\Dashboard;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function setupDashboardUser(string $role): array
+{
+    $team = Team::factory()->create();
+
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => $role]);
+
+    return [$user, $team];
+}
+
+function createProjectForTeam(Team $team): void
+{
+    Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $team->id,
+    ]);
+}
+
+function createServerWithKeyForTeam(Team $team): void
+{
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => $keyId,
+    ]);
+}
+
+test('admin sees add project button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('admin');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createProjectForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertSee('New Project');
+});
+
+test('member does not see add project button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('member');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createProjectForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertDontSee('New Project');
+});
+
+test('admin sees add server button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('admin');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createServerWithKeyForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertSee('New Server');
+});
+
+test('member does not see add server button on dashboard', function () {
+    [$user, $team] = setupDashboardUser('member');
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    createServerWithKeyForTeam($team);
+
+    Livewire::test(Dashboard::class)
+        ->assertDontSee('New Server');
+});
diff --git a/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php b/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php
new file mode 100644
index 000000000..89c3d5e2f
--- /dev/null
+++ b/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php
@@ -0,0 +1,188 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->databaseUrl = "/project/{$this->project->uuid}/environment/{$this->environment->uuid}/database/{$this->database->uuid}";
+});
+
+// --- Database Policy: view ---
+
+test('admin can view database', function () {
+    expect($this->admin->can('view', $this->database))->toBeTrue();
+});
+
+test('member can view database', function () {
+    expect($this->member->can('view', $this->database))->toBeTrue();
+});
+
+// --- Database Policy: update ---
+
+test('admin can update database', function () {
+    expect($this->admin->can('update', $this->database))->toBeTrue();
+});
+
+test('member cannot update database', function () {
+    expect($this->member->can('update', $this->database))->toBeFalse();
+});
+
+// --- Database Policy: delete ---
+
+test('admin can delete database', function () {
+    expect($this->admin->can('delete', $this->database))->toBeTrue();
+});
+
+test('member cannot delete database', function () {
+    expect($this->member->can('delete', $this->database))->toBeFalse();
+});
+
+// --- Database Policy: manage ---
+
+test('admin can manage database', function () {
+    expect($this->admin->can('manage', $this->database))->toBeTrue();
+});
+
+test('member cannot manage database', function () {
+    expect($this->member->can('manage', $this->database))->toBeFalse();
+});
+
+// --- Database Policy: manageBackups ---
+
+test('admin can manage database backups', function () {
+    expect($this->admin->can('manageBackups', $this->database))->toBeTrue();
+});
+
+test('member cannot manage database backups', function () {
+    expect($this->member->can('manageBackups', $this->database))->toBeFalse();
+});
+
+// --- Database Policy: manageEnvironment ---
+
+test('admin can manage database environment variables', function () {
+    expect($this->admin->can('manageEnvironment', $this->database))->toBeTrue();
+});
+
+test('member cannot manage database environment variables', function () {
+    expect($this->member->can('manageEnvironment', $this->database))->toBeFalse();
+});
+
+// --- Database page access ---
+
+test('admin can access database page', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $this->get($this->databaseUrl)->assertSuccessful();
+});
+
+test('member can access database page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get($this->databaseUrl)->assertSuccessful();
+});
+
+// --- Terminal access ---
+
+test('admin can access terminal for database', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeTrue();
+});
+
+test('member cannot access terminal for database', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeFalse();
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot view database', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('view', $this->database))->toBeFalse();
+});
+
+test('user from different team cannot update database', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('update', $this->database))->toBeFalse();
+});
+
+test('user from different team cannot manage database', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('manage', $this->database))->toBeFalse();
+});
diff --git a/tests/Feature/Authorization/DestinationOwnershipTest.php b/tests/Feature/Authorization/DestinationOwnershipTest.php
new file mode 100644
index 000000000..1a8bf4a97
--- /dev/null
+++ b/tests/Feature/Authorization/DestinationOwnershipTest.php
@@ -0,0 +1,60 @@
+<?php
+
+use App\Livewire\Destination\Show;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    // Team A owns the destination
+    $this->teamA = Team::factory()->create();
+    $this->userA = User::factory()->create();
+    $this->userA->teams()->attach($this->teamA, ['role' => 'admin']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Key A',
+        'private_key' => 'test-key-a',
+        'team_id' => $this->teamA->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->teamA->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    // Use the StandaloneDocker created by the Server factory
+    $this->destination = $this->server->standaloneDockers()->first();
+
+    // Team B is a different team
+    $this->teamB = Team::factory()->create();
+    $this->userB = User::factory()->create();
+    $this->userB->teams()->attach($this->teamB, ['role' => 'admin']);
+});
+
+test('team member can view their own destination', function () {
+    $this->actingAs($this->userA);
+    session(['currentTeam' => $this->teamA]);
+
+    Livewire::test(Show::class, ['destination_uuid' => $this->destination->uuid])
+        ->assertSet('name', $this->destination->name);
+});
+
+test('cross-team user cannot view destination', function () {
+    $this->actingAs($this->userB);
+    session(['currentTeam' => $this->teamB]);
+
+    Livewire::test(Show::class, ['destination_uuid' => $this->destination->uuid])
+        ->assertStatus(403);
+});
diff --git a/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
new file mode 100644
index 000000000..e30e2ad62
--- /dev/null
+++ b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
@@ -0,0 +1,274 @@
+<?php
+
+use App\Livewire\Project\Shared\EnvironmentVariable\All as EnvironmentVariableAll;
+use App\Livewire\Project\Shared\EnvironmentVariable\Show as EnvironmentVariableShow;
+use App\Models\Application;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0], ['is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->unlockedEnv = EnvironmentVariable::create([
+        'key' => 'UNLOCKED_VAR',
+        'value' => 'secret-unlocked-value',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $this->application->id,
+        'is_preview' => false,
+        'is_shown_once' => false,
+        'is_multiline' => false,
+        'is_literal' => false,
+        'is_runtime' => true,
+        'is_buildtime' => true,
+    ]);
+
+    $this->lockedEnv = EnvironmentVariable::create([
+        'key' => 'LOCKED_VAR',
+        'value' => 'secret-locked-value',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => $this->application->id,
+        'is_preview' => false,
+        'is_shown_once' => true,
+        'is_multiline' => false,
+        'is_literal' => false,
+        'is_runtime' => true,
+        'is_buildtime' => true,
+    ]);
+});
+
+// --- Livewire Show component: locked env values ---
+
+test('admin sees unlocked env value in Show component', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $this->unlockedEnv,
+        'type' => 'application',
+    ]);
+
+    expect($component->get('value'))->toBe('secret-unlocked-value');
+});
+
+test('admin cannot see locked env value in Show component', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $this->lockedEnv,
+        'type' => 'application',
+    ]);
+
+    expect($component->get('value'))->toBeNull();
+    expect($component->get('real_value'))->toBeNull();
+});
+
+test('member cannot see any env value in Show component', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $this->unlockedEnv,
+        'type' => 'application',
+    ]);
+
+    expect($component->get('value'))->toBeNull();
+    expect($component->get('real_value'))->toBeNull();
+});
+
+test('member has isValueHidden flag set to true', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $this->unlockedEnv,
+        'type' => 'application',
+    ]);
+
+    expect($component->get('isValueHidden'))->toBeTrue();
+});
+
+test('admin has isValueHidden flag set to false', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $this->unlockedEnv,
+        'type' => 'application',
+    ]);
+
+    expect($component->get('isValueHidden'))->toBeFalse();
+});
+
+// --- Livewire All component: dev view ---
+
+test('admin dev view shows unlocked env value', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableAll::class, [
+        'resource' => $this->application,
+    ]);
+
+    expect($component->get('variables'))->toContain('UNLOCKED_VAR=secret-unlocked-value');
+});
+
+test('admin dev view hides locked env value', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableAll::class, [
+        'resource' => $this->application,
+    ]);
+
+    expect($component->get('variables'))->toContain('LOCKED_VAR=(Locked Secret, delete and add again to change)');
+    expect($component->get('variables'))->not->toContain('secret-locked-value');
+});
+
+test('member dev view hides all env values', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(EnvironmentVariableAll::class, [
+        'resource' => $this->application,
+    ]);
+
+    expect($component->get('variables'))->not->toContain('secret-unlocked-value');
+    expect($component->get('variables'))->not->toContain('secret-locked-value');
+    expect($component->get('variables'))->toContain('UNLOCKED_VAR=(Hidden');
+});
+
+// --- API: locked env values hidden ---
+
+test('API hides locked env value even with read:sensitive token', function () {
+    session(['currentTeam' => $this->team]);
+    $token = $this->admin->createToken('admin-sensitive', ['read', 'read:sensitive']);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$token->plainTextToken,
+    ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+    $response->assertOk();
+
+    $envs = collect($response->json());
+    $locked = $envs->firstWhere('key', 'LOCKED_VAR');
+    $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+    expect($locked)->not->toBeNull();
+    expect($locked)->not->toHaveKey('value');
+    expect($locked)->not->toHaveKey('real_value');
+
+    expect($unlocked)->not->toBeNull();
+    expect($unlocked)->toHaveKey('value');
+});
+
+test('API hides locked env value with root token', function () {
+    session(['currentTeam' => $this->team]);
+    $token = $this->admin->createToken('admin-root', ['root']);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$token->plainTextToken,
+    ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+    $response->assertOk();
+
+    $envs = collect($response->json());
+    $locked = $envs->firstWhere('key', 'LOCKED_VAR');
+
+    expect($locked)->not->toBeNull();
+    expect($locked)->not->toHaveKey('value');
+    expect($locked)->not->toHaveKey('real_value');
+});
+
+// --- API: member role hides env values ---
+
+test('API hides env values for member even with read:sensitive token', function () {
+    session(['currentTeam' => $this->team]);
+    $token = $this->member->createToken('member-sensitive', ['read', 'read:sensitive']);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$token->plainTextToken,
+    ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+    $response->assertOk();
+
+    $envs = collect($response->json());
+    $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+    expect($unlocked)->not->toBeNull();
+    expect($unlocked)->not->toHaveKey('value');
+    expect($unlocked)->not->toHaveKey('real_value');
+});
+
+test('API shows env values for admin with read:sensitive token', function () {
+    session(['currentTeam' => $this->team]);
+    $token = $this->admin->createToken('admin-sensitive-2', ['read', 'read:sensitive']);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$token->plainTextToken,
+    ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
+    $response->assertOk();
+
+    $envs = collect($response->json());
+    $unlocked = $envs->firstWhere('key', 'UNLOCKED_VAR');
+
+    expect($unlocked)->not->toBeNull();
+    expect($unlocked)->toHaveKey('value');
+});
diff --git a/tests/Feature/Authorization/LegacyMemberTokenTest.php b/tests/Feature/Authorization/LegacyMemberTokenTest.php
new file mode 100644
index 000000000..273327985
--- /dev/null
+++ b/tests/Feature/Authorization/LegacyMemberTokenTest.php
@@ -0,0 +1,127 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::create(['id' => 0, 'is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+    $this->member = User::factory()->create();
+    $this->admin = User::factory()->create();
+
+    $this->team->members()->attach($this->member->id, ['role' => 'member']);
+    $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
+
+    session(['currentTeam' => $this->team]);
+});
+
+function apiRequest($test, string $token, string $method = 'get', string $url = '/api/v1/version')
+{
+    return $test->withHeaders([
+        'Authorization' => 'Bearer '.$token,
+        'Content-Type' => 'application/json',
+    ])->{$method.'Json'}($url);
+}
+
+describe('member with legacy elevated token is rejected', function () {
+    test('member with legacy write token gets 403 with descriptive message', function () {
+        $token = $this->member->createToken('legacy-write', ['read', 'write']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $response->assertJsonFragment([
+            'message' => 'This API token has permissions (write) that exceed your current role as a team member. Members are restricted to read-only API access. Please revoke this token and create a new one with only read permissions.',
+        ]);
+    });
+
+    test('member with legacy deploy token gets 403', function () {
+        $token = $this->member->createToken('legacy-deploy', ['read', 'deploy']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $response->assertSee('deploy');
+        $response->assertSee('revoke this token');
+    });
+
+    test('member with legacy root token gets 403', function () {
+        $token = $this->member->createToken('legacy-root', ['root']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $response->assertSee('root');
+    });
+
+    test('member with legacy read:sensitive token gets 403', function () {
+        $token = $this->member->createToken('legacy-sensitive', ['read', 'read:sensitive']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $response->assertSee('read:sensitive');
+    });
+
+    test('member with legacy write:sensitive token gets 403', function () {
+        $token = $this->member->createToken('legacy-ws', ['read', 'write:sensitive']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $response->assertSee('write:sensitive');
+    });
+
+    test('member with multiple disallowed abilities lists them all', function () {
+        $token = $this->member->createToken('legacy-multi', ['read', 'write', 'deploy', 'read:sensitive']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(403);
+        $json = $response->json();
+        expect($json['message'])->toContain('write');
+        expect($json['message'])->toContain('deploy');
+        expect($json['message'])->toContain('read:sensitive');
+    });
+});
+
+describe('member with read-only token passes through', function () {
+    test('member with read token can access read endpoints', function () {
+        $token = $this->member->createToken('read-only', ['read']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(200);
+    });
+});
+
+describe('admin with elevated token passes through', function () {
+    test('admin with write token is not blocked', function () {
+        $token = $this->admin->createToken('admin-write', ['read', 'write']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(200);
+    });
+
+    test('admin with root token is not blocked', function () {
+        $token = $this->admin->createToken('admin-root', ['root']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(200);
+    });
+
+    test('admin with deploy token is not blocked', function () {
+        $token = $this->admin->createToken('admin-deploy', ['read', 'deploy']);
+
+        $response = apiRequest($this, $token->plainTextToken);
+
+        $response->assertStatus(200);
+    });
+});
diff --git a/tests/Feature/Authorization/NavbarDeleteTeamAuthorizationTest.php b/tests/Feature/Authorization/NavbarDeleteTeamAuthorizationTest.php
new file mode 100644
index 000000000..580b83299
--- /dev/null
+++ b/tests/Feature/Authorization/NavbarDeleteTeamAuthorizationTest.php
@@ -0,0 +1,46 @@
+<?php
+
+use App\Livewire\NavbarDeleteTeam;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->owner = User::factory()->create();
+    $this->personalTeam = $this->owner->teams()->first();
+    $this->owner->teams()->updateExistingPivot($this->personalTeam->id, ['role' => 'owner']);
+
+    $this->teamToDelete = Team::create(['name' => 'Deletable Team', 'personal_team' => false]);
+    $this->teamToDelete->members()->attach($this->owner->id, ['role' => 'owner']);
+
+    $this->member = User::factory()->create();
+    $this->teamToDelete->members()->attach($this->member->id, ['role' => 'member']);
+});
+
+test('owner can delete team via navbar', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->teamToDelete]);
+
+    Livewire::test(NavbarDeleteTeam::class)
+        ->call('delete', 'password')
+        ->assertRedirect(route('team.index'));
+
+    expect(Team::find($this->teamToDelete->id))->toBeNull();
+});
+
+test('member cannot delete team via navbar', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->teamToDelete]);
+
+    Livewire::test(NavbarDeleteTeam::class)
+        ->call('delete', 'password')
+        ->assertDispatched('error');
+
+    expect(Team::find($this->teamToDelete->id))->not->toBeNull();
+});
diff --git a/tests/Feature/Authorization/NotificationAuthorizationTest.php b/tests/Feature/Authorization/NotificationAuthorizationTest.php
new file mode 100644
index 000000000..aa9d1cbdc
--- /dev/null
+++ b/tests/Feature/Authorization/NotificationAuthorizationTest.php
@@ -0,0 +1,349 @@
+<?php
+
+use App\Livewire\Notifications\Discord as DiscordNotification;
+use App\Livewire\Notifications\Email as EmailNotification;
+use App\Livewire\Notifications\Pushover as PushoverNotification;
+use App\Livewire\Notifications\Slack as SlackNotification;
+use App\Livewire\Notifications\Telegram as TelegramNotification;
+use App\Livewire\Notifications\Webhook as WebhookNotification;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+});
+
+// --- Discord ---
+
+test('member cannot send test notification on discord', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->discordNotificationSettings;
+    $settings->update([
+        'discord_enabled' => true,
+        'discord_webhook_url' => 'https://discord.com/api/webhooks/test',
+    ]);
+
+    Livewire::test(DiscordNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});
+
+test('member cannot update discord notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(DiscordNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('admin can update discord notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->discordNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Slack ---
+
+test('member cannot send test notification on slack', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->slackNotificationSettings;
+    $settings->update([
+        'slack_enabled' => true,
+        'slack_webhook_url' => 'https://hooks.slack.com/services/test',
+    ]);
+
+    Livewire::test(SlackNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});
+
+test('member cannot update slack notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(SlackNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('admin can update slack notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->slackNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Telegram ---
+
+test('member cannot send test notification on telegram', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->telegramNotificationSettings;
+    $settings->update([
+        'telegram_enabled' => true,
+        'telegram_token' => 'test-token',
+        'telegram_chat_id' => '123456',
+    ]);
+
+    Livewire::test(TelegramNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});
+
+test('member cannot update telegram notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TelegramNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('admin can update telegram notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->telegramNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Email ---
+
+test('member cannot send test email notification', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->emailNotificationSettings;
+    $settings->update([
+        'smtp_enabled' => true,
+        'smtp_host' => 'localhost',
+        'smtp_port' => 587,
+        'smtp_from_address' => 'test@test.com',
+        'smtp_from_name' => 'Test',
+    ]);
+
+    Livewire::test(EmailNotification::class)
+        ->call('sendTestEmail')
+        ->assertDispatched('error');
+});
+
+test('member cannot update email notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('member cannot copy instance email settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->call('copyFromInstanceSettings')
+        ->assertForbidden();
+});
+
+test('admin can update email notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->emailNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Pushover ---
+
+test('member cannot send test notification on pushover', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->pushoverNotificationSettings;
+    $settings->update([
+        'pushover_enabled' => true,
+        'pushover_app_token' => 'test-token',
+        'pushover_user_key' => 'test-user-key',
+    ]);
+
+    Livewire::test(PushoverNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});
+
+test('member cannot update pushover notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PushoverNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('admin can update pushover notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->pushoverNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Webhook ---
+
+test('member cannot send test notification on webhook', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->webhookNotificationSettings;
+    $settings->update([
+        'webhook_enabled' => true,
+        'webhook_url' => 'https://example.com/webhook',
+    ]);
+
+    Livewire::test(WebhookNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});
+
+test('member cannot update webhook notification settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(WebhookNotification::class)
+        ->call('syncData', true)
+        ->assertForbidden();
+});
+
+test('admin can update webhook notification settings', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $settings = $this->team->webhookNotificationSettings;
+
+    expect($this->admin->can('update', $settings))->toBeTrue();
+});
+
+// --- Send test policy checks ---
+
+test('admin can send test on all notification channels', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect($this->admin->can('sendTest', $this->team->discordNotificationSettings))->toBeTrue();
+    expect($this->admin->can('sendTest', $this->team->slackNotificationSettings))->toBeTrue();
+    expect($this->admin->can('sendTest', $this->team->telegramNotificationSettings))->toBeTrue();
+    expect($this->admin->can('sendTest', $this->team->emailNotificationSettings))->toBeTrue();
+    expect($this->admin->can('sendTest', $this->team->pushoverNotificationSettings))->toBeTrue();
+    expect($this->admin->can('sendTest', $this->team->webhookNotificationSettings))->toBeTrue();
+});
+
+test('member cannot send test on any notification channel', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect($this->member->can('sendTest', $this->team->discordNotificationSettings))->toBeFalse();
+    expect($this->member->can('sendTest', $this->team->slackNotificationSettings))->toBeFalse();
+    expect($this->member->can('sendTest', $this->team->telegramNotificationSettings))->toBeFalse();
+    expect($this->member->can('sendTest', $this->team->emailNotificationSettings))->toBeFalse();
+    expect($this->member->can('sendTest', $this->team->pushoverNotificationSettings))->toBeFalse();
+    expect($this->member->can('sendTest', $this->team->webhookNotificationSettings))->toBeFalse();
+});
+
+test('member cannot view notification secrets', function (string $component, string $settingsRelation, array $secrets) {
+    $settings = $this->team->{$settingsRelation};
+    $settings->update($secrets);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $componentTest = Livewire::test($component);
+
+    foreach ($secrets as $column => $value) {
+        $property = str($column)->camel()->toString();
+
+        $componentTest
+            ->assertSet($property, null)
+            ->assertDontSee($value);
+    }
+
+    $componentTest->assertSee('Hidden (only admins can view)');
+})->with([
+    'discord webhook' => [DiscordNotification::class, 'discordNotificationSettings', [
+        'discord_webhook_url' => 'https://discord.com/api/webhooks/secret-member',
+    ]],
+    'slack webhook' => [SlackNotification::class, 'slackNotificationSettings', [
+        'slack_webhook_url' => 'https://hooks.slack.com/services/secret-member',
+    ]],
+    'telegram token and chat id' => [TelegramNotification::class, 'telegramNotificationSettings', [
+        'telegram_token' => 'telegram-secret-token',
+        'telegram_chat_id' => 'telegram-secret-chat',
+    ]],
+    'pushover credentials' => [PushoverNotification::class, 'pushoverNotificationSettings', [
+        'pushover_user_key' => 'pushover-secret-user',
+        'pushover_api_token' => 'pushover-secret-token',
+    ]],
+    'generic webhook' => [WebhookNotification::class, 'webhookNotificationSettings', [
+        'webhook_url' => 'https://example.com/secret-webhook',
+    ]],
+]);
+
+test('admin can view notification secrets', function (string $component, string $settingsRelation, array $secrets) {
+    $settings = $this->team->{$settingsRelation};
+    $settings->update($secrets);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $componentTest = Livewire::test($component);
+
+    foreach ($secrets as $column => $value) {
+        $property = str($column)->camel()->toString();
+
+        $componentTest->assertSet($property, $value);
+    }
+})->with([
+    'discord webhook' => [DiscordNotification::class, 'discordNotificationSettings', [
+        'discord_webhook_url' => 'https://discord.com/api/webhooks/secret-admin',
+    ]],
+    'slack webhook' => [SlackNotification::class, 'slackNotificationSettings', [
+        'slack_webhook_url' => 'https://hooks.slack.com/services/secret-admin',
+    ]],
+    'telegram token and chat id' => [TelegramNotification::class, 'telegramNotificationSettings', [
+        'telegram_token' => 'telegram-admin-token',
+        'telegram_chat_id' => 'telegram-admin-chat',
+    ]],
+    'pushover credentials' => [PushoverNotification::class, 'pushoverNotificationSettings', [
+        'pushover_user_key' => 'pushover-admin-user',
+        'pushover_api_token' => 'pushover-admin-token',
+    ]],
+    'generic webhook' => [WebhookNotification::class, 'webhookNotificationSettings', [
+        'webhook_url' => 'https://example.com/admin-webhook',
+    ]],
+]);
diff --git a/tests/Feature/Authorization/ProjectEnvironmentAuthorizationTest.php b/tests/Feature/Authorization/ProjectEnvironmentAuthorizationTest.php
new file mode 100644
index 000000000..d1e01f0e6
--- /dev/null
+++ b/tests/Feature/Authorization/ProjectEnvironmentAuthorizationTest.php
@@ -0,0 +1,55 @@
+<?php
+
+use App\Livewire\Project\Show;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+});
+
+test('admin can create environment in project', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Show::class, ['project_uuid' => $this->project->uuid])
+        ->set('name', 'staging')
+        ->call('submit')
+        ->assertRedirect();
+
+    expect(Environment::where('name', 'staging')->exists())->toBeTrue();
+});
+
+test('member cannot create environment in project', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Show::class, ['project_uuid' => $this->project->uuid])
+        ->set('name', 'staging')
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect(Environment::where('name', 'staging')->exists())->toBeFalse();
+});
diff --git a/tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php b/tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php
new file mode 100644
index 000000000..03f11c22f
--- /dev/null
+++ b/tests/Feature/Authorization/ResourceHeadingAuthorizationTest.php
@@ -0,0 +1,248 @@
+<?php
+
+use App\Livewire\Project\Application\Heading as ApplicationHeading;
+use App\Livewire\Project\Service\Heading as ServiceHeading;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->service = Service::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Service',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'docker_compose_raw' => 'version: "3"',
+    ]);
+
+    $this->serviceParams = [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'service_uuid' => $this->service->uuid,
+    ];
+
+    $this->databaseUrl = "/project/{$this->project->uuid}/environment/{$this->environment->uuid}/database/{$this->database->uuid}";
+});
+
+// --- Application Heading ---
+
+test('admin sees deploy controls for application', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->assertSee('Redeploy')
+        ->assertSee('Restart')
+        ->assertSee('Stop');
+});
+
+test('member cannot call deploy on application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('deploy')
+        ->assertDispatched('error');
+});
+
+test('member cannot call restart on application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('restart')
+        ->assertDispatched('error');
+});
+
+test('member cannot call stop on application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->call('stop')
+        ->assertDispatched('error');
+});
+
+test('member does not see terminal link for application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->assertDontSee('Terminal');
+});
+
+test('admin sees terminal link for application', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ApplicationHeading::class, ['application' => $this->application])
+        ->assertSee('Terminal');
+});
+
+// --- Database Heading (via page route for rendering, policy checks for actions) ---
+
+test('admin can access database page', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $this->get($this->databaseUrl)->assertSuccessful();
+});
+
+test('member can access database page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get($this->databaseUrl)->assertSuccessful();
+});
+
+test('admin can manage database', function () {
+    expect($this->admin->can('manage', $this->database))->toBeTrue();
+});
+
+test('member cannot manage database', function () {
+    expect($this->member->can('manage', $this->database))->toBeFalse();
+});
+
+test('admin can access terminal for database', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeTrue();
+});
+
+test('member cannot access terminal for database', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeFalse();
+});
+
+// --- Service Heading ---
+
+test('admin sees service deploy button', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertSee('Deploy');
+});
+
+test('member cannot call stop on service', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->call('stop')
+        ->assertDispatched('error');
+});
+
+test('member does not see terminal link for service', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertDontSee('Terminal');
+});
+
+test('admin sees terminal link for service', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertSee('Terminal');
+});
diff --git a/tests/Feature/ResourceOperationsCrossTenantTest.php b/tests/Feature/Authorization/ResourceOperationsCrossTenantTest.php
similarity index 100%
rename from tests/Feature/ResourceOperationsCrossTenantTest.php
rename to tests/Feature/Authorization/ResourceOperationsCrossTenantTest.php
diff --git a/tests/Feature/Authorization/SecurityPageAuthorizationTest.php b/tests/Feature/Authorization/SecurityPageAuthorizationTest.php
new file mode 100644
index 000000000..94975f3c2
--- /dev/null
+++ b/tests/Feature/Authorization/SecurityPageAuthorizationTest.php
@@ -0,0 +1,112 @@
+<?php
+
+use App\Livewire\Notifications\Discord as DiscordNotification;
+use App\Livewire\Security\PrivateKey\Index as PrivateKeyIndex;
+use App\Livewire\Team\Member\Index as TeamMemberIndex;
+use App\Models\DiscordNotificationSettings;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    // Create a private key for the team (bypass model validation via DB insert)
+    DB::table('private_keys')->insert([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Team SSH Key',
+        'description' => 'Key for testing',
+        'private_key' => 'test-key-content',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+});
+
+// --- Private Key Index ---
+
+test('admin sees add and cleanup buttons on private key page', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyIndex::class)
+        ->assertSee('+ Add')
+        ->assertSee('Delete unused SSH Keys');
+});
+
+test('member does not see add or cleanup buttons on private key page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyIndex::class)
+        ->assertDontSee('+ Add')
+        ->assertDontSee('Delete unused SSH Keys');
+});
+
+test('member can view private key names on index page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    // Member can see key names (view is allowed for same-team members)
+    // but cannot see create/delete buttons (tested separately above)
+    Livewire::test(PrivateKeyIndex::class)
+        ->assertSee('Team SSH Key');
+});
+
+test('member cannot call cleanup unused keys', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyIndex::class)
+        ->call('cleanupUnusedKeys')
+        ->assertDispatched('error');
+});
+
+// --- Team Member Index (Invitations) ---
+
+test('admin sees invite section on team members page', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamMemberIndex::class)
+        ->assertSee('Invite New Member');
+});
+
+test('member does not see invite section on team members page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamMemberIndex::class)
+        ->assertDontSee('Invite New Member');
+});
+
+// --- Notification Settings (Discord as representative) ---
+
+test('member cannot send test notification on discord', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $settings = DiscordNotificationSettings::where('team_id', $this->team->id)->first();
+    $settings->update([
+        'discord_enabled' => true,
+        'discord_webhook_url' => 'https://discord.com/api/webhooks/test',
+    ]);
+
+    Livewire::test(DiscordNotification::class)
+        ->call('sendTestNotification')
+        ->assertDispatched('error');
+});
diff --git a/tests/Feature/Authorization/ServerAuthorizationTest.php b/tests/Feature/Authorization/ServerAuthorizationTest.php
new file mode 100644
index 000000000..ffcb4a1c6
--- /dev/null
+++ b/tests/Feature/Authorization/ServerAuthorizationTest.php
@@ -0,0 +1,263 @@
+<?php
+
+use App\Http\Middleware\PreventRequestsDuringMaintenance;
+use App\Livewire\Server\Navbar as ServerNavbar;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutMiddleware(PreventRequestsDuringMaintenance::class);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+});
+
+// --- Server Policy: update ---
+
+test('admin can update server', function () {
+    expect($this->admin->can('update', $this->server))->toBeTrue();
+});
+
+test('member cannot update server', function () {
+    expect($this->member->can('update', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: delete ---
+
+test('admin can delete server', function () {
+    expect($this->admin->can('delete', $this->server))->toBeTrue();
+});
+
+test('member cannot delete server', function () {
+    expect($this->member->can('delete', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: view ---
+
+test('admin can view server', function () {
+    expect($this->admin->can('view', $this->server))->toBeTrue();
+});
+
+test('member can view server', function () {
+    expect($this->member->can('view', $this->server))->toBeTrue();
+});
+
+// --- Server Policy: manageProxy ---
+
+test('admin can manage proxy', function () {
+    expect($this->admin->can('manageProxy', $this->server))->toBeTrue();
+});
+
+test('member cannot manage proxy', function () {
+    expect($this->member->can('manageProxy', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: manageSentinel ---
+
+test('admin can manage sentinel', function () {
+    expect($this->admin->can('manageSentinel', $this->server))->toBeTrue();
+});
+
+test('member cannot manage sentinel', function () {
+    expect($this->member->can('manageSentinel', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: manageCaCertificate ---
+
+test('admin can manage CA certificate', function () {
+    expect($this->admin->can('manageCaCertificate', $this->server))->toBeTrue();
+});
+
+test('member cannot manage CA certificate', function () {
+    expect($this->member->can('manageCaCertificate', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: viewSecurity ---
+
+test('admin can view security', function () {
+    expect($this->admin->can('viewSecurity', $this->server))->toBeTrue();
+});
+
+test('member cannot view security', function () {
+    expect($this->member->can('viewSecurity', $this->server))->toBeFalse();
+});
+
+// --- Server Policy: create ---
+
+test('admin can create server', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', Server::class))->toBeTrue();
+});
+
+test('member cannot create server', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('create', Server::class))->toBeFalse();
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot view server', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('view', $this->server))->toBeFalse();
+});
+
+test('user from different team cannot update server', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('update', $this->server))->toBeFalse();
+});
+
+// --- Navbar Livewire component actions ---
+
+test('member cannot restart proxy via navbar', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServerNavbar::class, ['server' => $this->server])
+        ->call('restart')
+        ->assertDispatched('error');
+});
+
+test('member cannot check proxy via navbar', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServerNavbar::class, ['server' => $this->server])
+        ->call('checkProxy')
+        ->assertDispatched('error');
+});
+
+test('member cannot start proxy via navbar', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServerNavbar::class, ['server' => $this->server])
+        ->call('startProxy')
+        ->assertDispatched('error');
+});
+
+test('member cannot stop proxy via navbar', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServerNavbar::class, ['server' => $this->server])
+        ->call('stop')
+        ->assertDispatched('error');
+});
+
+// --- Terminal access gate ---
+
+test('admin can access terminal', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeTrue();
+});
+
+test('member cannot access terminal', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('canAccessTerminal'))->toBeFalse();
+});
+
+// --- Server page access ---
+
+test('admin can access server page', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $this->get("/server/{$this->server->uuid}")->assertSuccessful();
+});
+
+test('member can access server page', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get("/server/{$this->server->uuid}")->assertSuccessful();
+});
+
+test('admin can access sentinel configuration and logs pages', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $this->get(route('server.sentinel', ['server_uuid' => $this->server->uuid]))
+        ->assertSuccessful();
+
+    $this->get(route('server.sentinel.logs', ['server_uuid' => $this->server->uuid]))
+        ->assertSuccessful();
+});
+
+test('member cannot access sentinel configuration and logs pages', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get(route('server.sentinel', ['server_uuid' => $this->server->uuid]))
+        ->assertForbidden();
+
+    $this->get(route('server.sentinel.logs', ['server_uuid' => $this->server->uuid]))
+        ->assertForbidden();
+});
+
+test('sentinel navigation is only visible to team admins', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get("/server/{$this->server->uuid}")
+        ->assertSuccessful()
+        ->assertDontSee(route('server.sentinel', ['server_uuid' => $this->server->uuid]));
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $this->get("/server/{$this->server->uuid}")
+        ->assertSuccessful()
+        ->assertSee(route('server.sentinel', ['server_uuid' => $this->server->uuid]));
+});
+
+test('unauthenticated user cannot access server page', function () {
+    $this->get("/server/{$this->server->uuid}")->assertRedirect('/login');
+});
diff --git a/tests/Feature/Authorization/ServiceConfigAuthorizationTest.php b/tests/Feature/Authorization/ServiceConfigAuthorizationTest.php
new file mode 100644
index 000000000..ab5c12376
--- /dev/null
+++ b/tests/Feature/Authorization/ServiceConfigAuthorizationTest.php
@@ -0,0 +1,242 @@
+<?php
+
+use App\Livewire\Project\Service\Heading as ServiceHeading;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->service = Service::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Service',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'docker_compose_raw' => 'version: "3"',
+    ]);
+
+    $this->serviceParams = [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'service_uuid' => $this->service->uuid,
+    ];
+});
+
+// --- Service Policy: view ---
+
+test('admin can view service', function () {
+    expect($this->admin->can('view', $this->service))->toBeTrue();
+});
+
+test('member can view service', function () {
+    expect($this->member->can('view', $this->service))->toBeTrue();
+});
+
+// --- Service Policy: update ---
+
+test('admin can update service', function () {
+    expect($this->admin->can('update', $this->service))->toBeTrue();
+});
+
+test('member cannot update service', function () {
+    expect($this->member->can('update', $this->service))->toBeFalse();
+});
+
+// --- Service Policy: delete ---
+
+test('admin can delete service', function () {
+    expect($this->admin->can('delete', $this->service))->toBeTrue();
+});
+
+test('member cannot delete service', function () {
+    expect($this->member->can('delete', $this->service))->toBeFalse();
+});
+
+// --- Service Policy: deploy ---
+
+test('admin can deploy service', function () {
+    expect($this->admin->can('deploy', $this->service))->toBeTrue();
+});
+
+test('member cannot deploy service', function () {
+    expect($this->member->can('deploy', $this->service))->toBeFalse();
+});
+
+// --- Service Policy: stop ---
+
+test('admin can stop service', function () {
+    expect($this->admin->can('stop', $this->service))->toBeTrue();
+});
+
+test('member cannot stop service', function () {
+    expect($this->member->can('stop', $this->service))->toBeFalse();
+});
+
+// --- Service Policy: manageEnvironment ---
+
+test('admin can manage service environment variables', function () {
+    expect($this->admin->can('manageEnvironment', $this->service))->toBeTrue();
+});
+
+test('member cannot manage service environment variables', function () {
+    expect($this->member->can('manageEnvironment', $this->service))->toBeFalse();
+});
+
+// --- Service Heading Livewire actions ---
+
+test('member cannot call start on service heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->call('start')
+        ->assertDispatched('error');
+});
+
+test('member cannot call stop on service heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->call('stop')
+        ->assertDispatched('error');
+});
+
+test('member cannot call restart on service heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->call('restart')
+        ->assertDispatched('error');
+});
+
+test('member cannot call force deploy on service heading', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->call('forceDeploy')
+        ->assertDispatched('error');
+});
+
+// --- Service Heading visibility ---
+
+test('member does not see terminal link for service', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertDontSee('Terminal');
+});
+
+test('admin sees terminal link for service', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertSee('Terminal');
+});
+
+test('admin sees deploy button for service', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(ServiceHeading::class, [
+        'service' => $this->service,
+        'parameters' => $this->serviceParams,
+        'query' => [],
+    ])
+        ->assertSee('Deploy');
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot view service', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('view', $this->service))->toBeFalse();
+});
+
+test('user from different team cannot update service', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('update', $this->service))->toBeFalse();
+});
diff --git a/tests/Feature/Authorization/SharedResourceAuthorizationTest.php b/tests/Feature/Authorization/SharedResourceAuthorizationTest.php
new file mode 100644
index 000000000..57e46c418
--- /dev/null
+++ b/tests/Feature/Authorization/SharedResourceAuthorizationTest.php
@@ -0,0 +1,301 @@
+<?php
+
+use App\Livewire\Project\Shared\Danger;
+use App\Livewire\Project\Shared\Tags;
+use App\Livewire\Project\Shared\Webhooks;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->service = Service::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Service',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'docker_compose_raw' => 'version: "3"',
+    ]);
+});
+
+// --- Danger Zone: Application ---
+
+test('admin can delete application', function () {
+    expect($this->admin->can('delete', $this->application))->toBeTrue();
+});
+
+test('member cannot delete application via danger zone', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Danger::class, ['resource' => $this->application])
+        ->call('delete', 'password')
+        ->assertDispatched('error');
+});
+
+// --- Danger Zone: Database ---
+
+test('admin can delete database', function () {
+    expect($this->admin->can('delete', $this->database))->toBeTrue();
+});
+
+test('member cannot delete database via danger zone', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Danger::class, ['resource' => $this->database])
+        ->call('delete', 'password')
+        ->assertDispatched('error');
+});
+
+// --- Danger Zone: Service ---
+
+test('admin can delete service', function () {
+    expect($this->admin->can('delete', $this->service))->toBeTrue();
+});
+
+test('member cannot delete service via danger zone', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Danger::class, ['resource' => $this->service])
+        ->call('delete', 'password')
+        ->assertDispatched('error');
+});
+
+// --- Tags: Application ---
+
+test('member cannot add tag to application', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Tags::class, ['resource' => $this->application])
+        ->set('newTags', 'test-tag')
+        ->call('submit')
+        ->assertDispatched('error');
+});
+
+test('admin can add tag to application', function () {
+    expect($this->admin->can('update', $this->application))->toBeTrue();
+});
+
+// --- Webhooks: Application ---
+
+test('member cannot update application webhooks', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Webhooks::class, ['resource' => $this->application])
+        ->call('submit')
+        ->assertDispatched('error');
+});
+
+test('admin can update application webhooks', function () {
+    expect($this->admin->can('update', $this->application))->toBeTrue();
+});
+
+test('member cannot view application webhook secrets', function () {
+    $this->application->update([
+        'git_repository' => 'coollabsio/coolify',
+        'git_branch' => 'main',
+        'manual_webhook_secret_github' => 'github-secret-value',
+        'manual_webhook_secret_gitlab' => 'gitlab-secret-value',
+        'manual_webhook_secret_bitbucket' => 'bitbucket-secret-value',
+        'manual_webhook_secret_gitea' => 'gitea-secret-value',
+    ]);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Webhooks::class, ['resource' => $this->application->fresh()])
+        ->assertSet('githubManualWebhookSecret', null)
+        ->assertSet('gitlabManualWebhookSecret', null)
+        ->assertSet('bitbucketManualWebhookSecret', null)
+        ->assertSet('giteaManualWebhookSecret', null)
+        ->assertSee('Hidden (only admins can view)')
+        ->assertDontSee('github-secret-value')
+        ->assertDontSee('gitlab-secret-value')
+        ->assertDontSee('bitbucket-secret-value')
+        ->assertDontSee('gitea-secret-value');
+});
+
+test('admin can view application webhook secrets', function () {
+    $this->application->update([
+        'git_repository' => 'coollabsio/coolify',
+        'git_branch' => 'main',
+        'manual_webhook_secret_github' => 'github-secret-value',
+        'manual_webhook_secret_gitlab' => 'gitlab-secret-value',
+        'manual_webhook_secret_bitbucket' => 'bitbucket-secret-value',
+        'manual_webhook_secret_gitea' => 'gitea-secret-value',
+    ]);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Webhooks::class, ['resource' => $this->application->fresh()])
+        ->assertSet('githubManualWebhookSecret', 'github-secret-value')
+        ->assertSet('gitlabManualWebhookSecret', 'gitlab-secret-value')
+        ->assertSet('bitbucketManualWebhookSecret', 'bitbucket-secret-value')
+        ->assertSet('giteaManualWebhookSecret', 'gitea-secret-value');
+});
+
+// --- Resource Limits (policy checks, mount requires full resource data) ---
+
+test('member cannot update application resource limits', function () {
+    expect($this->member->can('update', $this->application))->toBeFalse();
+});
+
+test('admin can update application resource limits', function () {
+    expect($this->admin->can('update', $this->application))->toBeTrue();
+});
+
+test('member cannot update database resource limits', function () {
+    expect($this->member->can('update', $this->database))->toBeFalse();
+});
+
+test('member cannot update service resource limits', function () {
+    expect($this->member->can('update', $this->service))->toBeFalse();
+});
+
+// --- Environment Variables (Policy checks) ---
+
+test('admin can manage application environment variables', function () {
+    expect($this->admin->can('manageEnvironment', $this->application))->toBeTrue();
+});
+
+test('member cannot manage application environment variables', function () {
+    expect($this->member->can('manageEnvironment', $this->application))->toBeFalse();
+});
+
+test('admin can manage database environment variables', function () {
+    expect($this->admin->can('manageEnvironment', $this->database))->toBeTrue();
+});
+
+test('member cannot manage database environment variables', function () {
+    expect($this->member->can('manageEnvironment', $this->database))->toBeFalse();
+});
+
+test('admin can manage service environment variables', function () {
+    expect($this->admin->can('manageEnvironment', $this->service))->toBeTrue();
+});
+
+test('member cannot manage service environment variables', function () {
+    expect($this->member->can('manageEnvironment', $this->service))->toBeFalse();
+});
+
+// --- Project Policy ---
+
+test('admin can update project', function () {
+    expect($this->admin->can('update', $this->project))->toBeTrue();
+});
+
+test('member cannot update project', function () {
+    expect($this->member->can('update', $this->project))->toBeFalse();
+});
+
+test('admin can delete project', function () {
+    expect($this->admin->can('delete', $this->project))->toBeTrue();
+});
+
+test('member cannot delete project', function () {
+    expect($this->member->can('delete', $this->project))->toBeFalse();
+});
+
+// --- Environment Policy ---
+
+test('admin can delete environment', function () {
+    expect($this->admin->can('delete', $this->environment))->toBeTrue();
+});
+
+test('member cannot delete environment', function () {
+    expect($this->member->can('delete', $this->environment))->toBeFalse();
+});
+
+// --- Team Policy ---
+
+test('admin can update team', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeTrue();
+});
+
+test('member cannot update team', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeFalse();
+});
diff --git a/tests/Feature/Authorization/TeamAuthorizationTest.php b/tests/Feature/Authorization/TeamAuthorizationTest.php
new file mode 100644
index 000000000..82d8d2afc
--- /dev/null
+++ b/tests/Feature/Authorization/TeamAuthorizationTest.php
@@ -0,0 +1,327 @@
+<?php
+
+use App\Livewire\Team\Index as TeamIndex;
+use App\Livewire\Team\Member as TeamMember;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create(['personal_team' => false]);
+
+    $this->owner = User::factory()->create();
+    $this->owner->teams()->attach($this->team, ['role' => 'owner']);
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+});
+
+// --- Team Policy: update ---
+
+test('owner can update team', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeTrue();
+});
+
+test('admin can update team', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeTrue();
+});
+
+test('member cannot update team', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeFalse();
+});
+
+// --- Team Policy: delete ---
+
+test('owner can delete team', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('delete', $this->team))->toBeTrue();
+});
+
+test('admin can delete team', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('delete', $this->team))->toBeTrue();
+});
+
+test('member cannot delete team', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('delete', $this->team))->toBeFalse();
+});
+
+// --- Team Policy: manageMembers ---
+
+test('owner can manage team members', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageMembers', $this->team))->toBeTrue();
+});
+
+test('admin can manage team members', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageMembers', $this->team))->toBeTrue();
+});
+
+test('member cannot manage team members', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageMembers', $this->team))->toBeFalse();
+});
+
+// --- Team Policy: manageInvitations ---
+
+test('owner can manage invitations', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageInvitations', $this->team))->toBeTrue();
+});
+
+test('admin can manage invitations', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageInvitations', $this->team))->toBeTrue();
+});
+
+test('member cannot manage invitations', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageInvitations', $this->team))->toBeFalse();
+});
+
+// --- Team Index Livewire: update ---
+
+test('member cannot submit team settings via policy', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeFalse();
+});
+
+// --- Team Index Livewire: delete ---
+
+test('member cannot delete team via index', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamIndex::class)
+        ->call('delete', 'password')
+        ->assertDispatched('error');
+
+    expect(Team::find($this->team->id))->not->toBeNull();
+});
+
+test('admin can delete team via policy', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('delete', $this->team))->toBeTrue();
+});
+
+// --- Team Member Livewire: role changes ---
+
+test('member cannot change roles via team member component', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamMember::class, ['member' => $this->admin])
+        ->call('makeAdmin')
+        ->assertDispatched('error');
+});
+
+test('member cannot remove team members', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamMember::class, ['member' => $this->admin])
+        ->call('remove')
+        ->assertDispatched('error');
+});
+
+// --- Invitations & Invite Link (policy checks — views wrapped in @can render empty for members) ---
+
+test('member cannot manage invitations via policy', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageInvitations', $this->team))->toBeFalse();
+});
+
+test('owner can manage invitations via policy', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('manageInvitations', $this->team))->toBeTrue();
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot update team', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'owner']);
+
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    expect(auth()->user()->can('update', $this->team))->toBeFalse();
+});
+
+test('user from different team cannot manage members', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'owner']);
+
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    expect(auth()->user()->can('manageMembers', $this->team))->toBeFalse();
+});
+
+// --- Team Policy: view ---
+
+test('owner can view team', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('view', $this->team))->toBeTrue();
+});
+
+test('admin can view team', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('view', $this->team))->toBeTrue();
+});
+
+test('member can view team', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('view', $this->team))->toBeTrue();
+});
+
+test('non-team member cannot view team', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('view', $this->team))->toBeFalse();
+});
+
+// --- Team Policy: viewAdmin ---
+
+test('owner can view admin panel', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('viewAdmin', $this->team))->toBeTrue();
+});
+
+test('admin can view admin panel', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('viewAdmin', $this->team))->toBeTrue();
+});
+
+test('member cannot view admin panel', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(auth()->user()->can('viewAdmin', $this->team))->toBeFalse();
+});
+
+test('non-team member cannot view admin panel', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('viewAdmin', $this->team))->toBeFalse();
+});
+
+// --- Non-team member isolation ---
+
+test('non-team member cannot update team', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('update', $this->team))->toBeFalse();
+});
+
+test('non-team member cannot delete team', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('delete', $this->team))->toBeFalse();
+});
+
+test('non-team member cannot manage members', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('manageMembers', $this->team))->toBeFalse();
+});
+
+test('non-team member cannot manage invitations', function () {
+    $outsider = User::factory()->create();
+    $this->actingAs($outsider);
+    session(['currentTeam' => $this->team]);
+
+    expect($outsider->can('manageInvitations', $this->team))->toBeFalse();
+});
+
+// --- Team creation and model-level protection ---
+
+test('member can create a new independent team', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $newTeam = Team::create([
+        'name' => 'New Team',
+        'description' => 'Created by member',
+        'personal_team' => false,
+    ]);
+
+    expect($newTeam)->toBeInstanceOf(Team::class)
+        ->and($newTeam->name)->toBe('New Team');
+});
+
+test('member cannot update an existing team at model level', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    expect(fn () => $this->team->update(['name' => 'Hacked']))
+        ->toThrow(Exception::class, 'You are not allowed to update this team.');
+});
diff --git a/tests/Feature/Authorization/UploadBackupAuthorizationTest.php b/tests/Feature/Authorization/UploadBackupAuthorizationTest.php
new file mode 100644
index 000000000..126e6ef52
--- /dev/null
+++ b/tests/Feature/Authorization/UploadBackupAuthorizationTest.php
@@ -0,0 +1,186 @@
+<?php
+
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test DB',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'image' => 'postgres:15',
+        'status' => 'running',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+
+    $this->service = Service::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'test-service',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'docker_compose_raw' => 'version: "3"',
+    ]);
+
+    $this->serviceDatabase = ServiceDatabase::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'test-service-db',
+        'service_id' => $this->service->id,
+    ]);
+});
+
+// --- DatabasePolicy::uploadBackup (covers Standalone* databases) ---
+
+test('admin can upload backup for standalone database', function () {
+    expect($this->admin->can('uploadBackup', $this->database))->toBeTrue();
+});
+
+test('member cannot upload backup for standalone database', function () {
+    expect($this->member->can('uploadBackup', $this->database))->toBeFalse();
+});
+
+// --- ApplicationPolicy::uploadBackup ---
+
+test('admin can upload backup for application', function () {
+    expect($this->admin->can('uploadBackup', $this->application))->toBeTrue();
+});
+
+test('member cannot upload backup for application', function () {
+    expect($this->member->can('uploadBackup', $this->application))->toBeFalse();
+});
+
+// --- ServicePolicy::uploadBackup ---
+
+test('admin can upload backup for service', function () {
+    expect($this->admin->can('uploadBackup', $this->service))->toBeTrue();
+});
+
+test('member cannot upload backup for service', function () {
+    expect($this->member->can('uploadBackup', $this->service))->toBeFalse();
+});
+
+// --- ServiceDatabasePolicy::uploadBackup (delegates to ServicePolicy) ---
+
+test('admin can upload backup for service database', function () {
+    expect($this->admin->can('uploadBackup', $this->serviceDatabase))->toBeTrue();
+});
+
+test('member cannot upload backup for service database', function () {
+    expect($this->member->can('uploadBackup', $this->serviceDatabase))->toBeFalse();
+});
+
+// --- Cross-team isolation ---
+
+test('user from different team cannot upload backup', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    expect($otherUser->can('uploadBackup', $this->database))->toBeFalse();
+    expect($otherUser->can('uploadBackup', $this->application))->toBeFalse();
+    expect($otherUser->can('uploadBackup', $this->service))->toBeFalse();
+    expect($otherUser->can('uploadBackup', $this->serviceDatabase))->toBeFalse();
+});
+
+// --- HTTP endpoint: POST /upload/backup/{uuid} ---
+
+test('member gets 403 from POST /upload/backup and no file lands on disk', function () {
+    $uploadDir = storage_path('app/upload/'.$this->database->uuid);
+    if (File::exists($uploadDir)) {
+        File::deleteDirectory($uploadDir);
+    }
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $response = $this->post(route('upload.backup', ['databaseUuid' => $this->database->uuid]));
+
+    $response->assertForbidden();
+
+    expect(File::exists($uploadDir.'/restore'))->toBeFalse();
+});
+
+test('user from different team hits null-resource branch with 500', function () {
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherUser->teams()->attach($otherTeam, ['role' => 'admin']);
+
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    $response = $this->post(route('upload.backup', ['databaseUuid' => $this->database->uuid]));
+
+    $response->assertStatus(500);
+});
+
+test('unauthenticated request is redirected to login', function () {
+    $response = $this->post(route('upload.backup', ['databaseUuid' => $this->database->uuid]));
+
+    $response->assertRedirect('/login');
+});
diff --git a/tests/Feature/CoolifyTaskRetryTest.php b/tests/Feature/CoolifyTaskRetryTest.php
deleted file mode 100644
index f46ced311..000000000
--- a/tests/Feature/CoolifyTaskRetryTest.php
+++ /dev/null
@@ -1,70 +0,0 @@
-<?php
-
-use App\Jobs\CoolifyTask;
-use App\Models\Server;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\Queue;
-
-uses(RefreshDatabase::class);
-
-it('can dispatch CoolifyTask successfully', function () {
-    // Skip if no servers available
-    $server = Server::where('ip', '!=', '1.2.3.4')->first();
-
-    if (! $server) {
-        $this->markTestSkipped('No servers available for testing');
-    }
-
-    Queue::fake();
-
-    // Create an activity for the task
-    $activity = activity()
-        ->withProperties([
-            'server_uuid' => $server->uuid,
-            'command' => 'echo "test"',
-            'type' => 'inline',
-        ])
-        ->event('inline')
-        ->log('[]');
-
-    // Dispatch the job
-    CoolifyTask::dispatch(
-        activity: $activity,
-        ignore_errors: false,
-        call_event_on_finish: null,
-        call_event_data: null
-    );
-
-    // Assert job was dispatched
-    Queue::assertPushed(CoolifyTask::class);
-});
-
-it('has correct retry configuration on CoolifyTask', function () {
-    $server = Server::where('ip', '!=', '1.2.3.4')->first();
-
-    if (! $server) {
-        $this->markTestSkipped('No servers available for testing');
-    }
-
-    $activity = activity()
-        ->withProperties([
-            'server_uuid' => $server->uuid,
-            'command' => 'echo "test"',
-            'type' => 'inline',
-        ])
-        ->event('inline')
-        ->log('[]');
-
-    $job = new CoolifyTask(
-        activity: $activity,
-        ignore_errors: false,
-        call_event_on_finish: null,
-        call_event_data: null
-    );
-
-    // Assert retry configuration
-    expect($job->tries)->toBe(3);
-    expect($job->maxExceptions)->toBe(1);
-    expect($job->timeout)->toBe(600);
-    expect($job->backoff())->toBe([30, 90, 180]);
-});
diff --git a/tests/Feature/DatabaseBackupCreationApiTest.php b/tests/Feature/DatabaseBackupCreationApiTest.php
deleted file mode 100644
index 4588cf9de..000000000
--- a/tests/Feature/DatabaseBackupCreationApiTest.php
+++ /dev/null
@@ -1,207 +0,0 @@
-<?php
-
-use App\Models\Environment;
-use App\Models\InstanceSettings;
-use App\Models\Project;
-use App\Models\S3Storage;
-use App\Models\ScheduledDatabaseBackup;
-use App\Models\Server;
-use App\Models\StandaloneDocker;
-use App\Models\StandalonePostgresql;
-use App\Models\Team;
-use App\Models\User;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-
-uses(RefreshDatabase::class);
-
-beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
-
-    $this->team = Team::factory()->create();
-    $this->user = User::factory()->create();
-    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
-
-    session(['currentTeam' => $this->team]);
-
-    $this->token = $this->user->createToken('test-token', ['*']);
-    $this->bearerToken = $this->token->plainTextToken;
-
-    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
-    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
-    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
-    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
-
-    $this->database = StandalonePostgresql::create([
-        'name' => 'test-postgres',
-        'image' => 'postgres:15-alpine',
-        'postgres_user' => 'postgres',
-        'postgres_password' => 'password',
-        'postgres_db' => 'testdb',
-        'environment_id' => $this->environment->id,
-        'destination_id' => $this->destination->id,
-        'destination_type' => $this->destination->getMorphClass(),
-    ]);
-
-    $this->s3Storage = S3Storage::create([
-        'name' => 'test-s3',
-        'region' => 'us-east-1',
-        'key' => 'test-key',
-        'secret' => 'test-secret',
-        'bucket' => 'test-bucket',
-        'endpoint' => 'https://s3.example.com',
-        'team_id' => $this->team->id,
-        'is_usable' => true,
-    ]);
-});
-
-describe('POST /api/v1/databases/{uuid}/backups', function () {
-    test('creates backup with s3 storage via API token', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
-            'frequency' => '0 2 * * 0',
-            'save_s3' => true,
-            's3_storage_uuid' => $this->s3Storage->uuid,
-            'enabled' => true,
-        ]);
-
-        $response->assertStatus(201);
-        $response->assertJsonStructure(['uuid', 'message']);
-
-        $backup = ScheduledDatabaseBackup::where('uuid', $response->json('uuid'))->first();
-        expect($backup)->not->toBeNull();
-        expect($backup->s3_storage_id)->toBe($this->s3Storage->id);
-        expect($backup->save_s3)->toBeTrue();
-        expect($backup->team_id)->toBe($this->team->id);
-    });
-
-    test('creates backup without s3 storage', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
-            'frequency' => 'daily',
-        ]);
-
-        $response->assertStatus(201);
-        $response->assertJsonStructure(['uuid', 'message']);
-    });
-
-    test('rejects s3_storage_uuid from another team', function () {
-        $otherTeam = Team::factory()->create();
-        $otherS3 = S3Storage::create([
-            'name' => 'other-s3',
-            'region' => 'us-east-1',
-            'key' => 'other-key',
-            'secret' => 'other-secret',
-            'bucket' => 'other-bucket',
-            'endpoint' => 'https://s3.example.com',
-            'team_id' => $otherTeam->id,
-            'is_usable' => true,
-        ]);
-
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
-            'frequency' => '0 2 * * 0',
-            'save_s3' => true,
-            's3_storage_uuid' => $otherS3->uuid,
-        ]);
-
-        $response->assertStatus(422);
-        $response->assertJsonValidationErrors(['s3_storage_uuid']);
-    });
-
-    test('validates frequency is required', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
-            'enabled' => true,
-        ]);
-
-        $response->assertStatus(422);
-        $response->assertJsonValidationErrors(['frequency']);
-    });
-
-    test('validates s3_storage_uuid required when save_s3 is true', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
-            'frequency' => 'daily',
-            'save_s3' => true,
-        ]);
-
-        $response->assertStatus(422);
-        $response->assertJsonValidationErrors(['s3_storage_uuid']);
-    });
-
-    test('rejects request without authentication', function () {
-        $response = $this->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
-            'frequency' => 'daily',
-        ]);
-
-        $response->assertStatus(401);
-    });
-});
-
-describe('PATCH /api/v1/databases/{uuid}/backups/{scheduled_backup_uuid}', function () {
-    test('updates backup to use s3 storage via API token', function () {
-        $backup = ScheduledDatabaseBackup::create([
-            'frequency' => 'daily',
-            'enabled' => true,
-            'database_id' => $this->database->id,
-            'database_type' => $this->database->getMorphClass(),
-            'team_id' => $this->team->id,
-        ]);
-
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
-            'save_s3' => true,
-            's3_storage_uuid' => $this->s3Storage->uuid,
-        ]);
-
-        $response->assertStatus(200);
-        $backup->refresh();
-        expect($backup->s3_storage_id)->toBe($this->s3Storage->id);
-        expect($backup->save_s3)->toBeTrue();
-    });
-
-    test('rejects s3_storage_uuid from another team on update', function () {
-        $otherTeam = Team::factory()->create();
-        $otherS3 = S3Storage::create([
-            'name' => 'other-s3',
-            'region' => 'us-east-1',
-            'key' => 'other-key',
-            'secret' => 'other-secret',
-            'bucket' => 'other-bucket',
-            'endpoint' => 'https://s3.example.com',
-            'team_id' => $otherTeam->id,
-            'is_usable' => true,
-        ]);
-
-        $backup = ScheduledDatabaseBackup::create([
-            'frequency' => 'daily',
-            'enabled' => true,
-            'database_id' => $this->database->id,
-            'database_type' => $this->database->getMorphClass(),
-            'team_id' => $this->team->id,
-        ]);
-
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
-            'save_s3' => true,
-            's3_storage_uuid' => $otherS3->uuid,
-        ]);
-
-        $response->assertStatus(422);
-        $response->assertJsonValidationErrors(['s3_storage_uuid']);
-    });
-});
diff --git a/tests/Feature/ConvertContainerEnvsToArray.php b/tests/Feature/EnvironmentVariable/ConvertContainerEnvsToArrayTest.php
similarity index 100%
rename from tests/Feature/ConvertContainerEnvsToArray.php
rename to tests/Feature/EnvironmentVariable/ConvertContainerEnvsToArrayTest.php
diff --git a/tests/Feature/EnvironmentVariableSharedSpacingTest.php b/tests/Feature/EnvironmentVariable/EnvironmentVariableSharedSpacingTest.php
similarity index 100%
rename from tests/Feature/EnvironmentVariableSharedSpacingTest.php
rename to tests/Feature/EnvironmentVariable/EnvironmentVariableSharedSpacingTest.php
diff --git a/tests/Feature/MultilineEnvironmentVariableTest.php b/tests/Feature/EnvironmentVariable/MultilineEnvironmentVariableTest.php
similarity index 100%
rename from tests/Feature/MultilineEnvironmentVariableTest.php
rename to tests/Feature/EnvironmentVariable/MultilineEnvironmentVariableTest.php
diff --git a/tests/Feature/ExecuteContainerCommandTest.php b/tests/Feature/ExecuteContainerCommandTest.php
deleted file mode 100644
index 6d485fe65..000000000
--- a/tests/Feature/ExecuteContainerCommandTest.php
+++ /dev/null
@@ -1,57 +0,0 @@
-<?php
-
-namespace Tests\Feature;
-
-use App\Models\Application;
-use App\Models\Server;
-use App\Models\User;
-use PHPUnit\Framework\Attributes\Test;
-use Tests\TestCase;
-use Tests\Traits\HandlesTestDatabase;
-
-class ExecuteContainerCommandTest extends TestCase
-{
-    use HandlesTestDatabase;
-
-    private $user;
-
-    private $team;
-
-    private $server;
-
-    private $application;
-
-    protected function setUp(): void
-    {
-        parent::setUp();
-
-        // Only set up database for tests that need it
-        if ($this->shouldSetUpDatabase()) {
-            $this->setUpTestDatabase();
-        }
-        // Create test data
-        $this->user = User::factory()->create();
-        $this->team = $this->user->teams()->first();
-        $this->server = Server::factory()->create(['team_id' => $this->team->id]);
-        $this->application = Application::factory()->create();
-
-        // Login the user
-        $this->actingAs($this->user);
-    }
-
-    protected function tearDown(): void
-    {
-        if ($this->shouldSetUpDatabase()) {
-            $this->tearDownTestDatabase();
-        }
-        parent::tearDown();
-    }
-
-    private function shouldSetUpDatabase(): bool
-    {
-        return in_array($this->name(), [
-            'it_allows_valid_container_access',
-            'it_prevents_cross_server_container_access',
-        ]);
-    }
-}
diff --git a/tests/Feature/CloudInitScriptTest.php b/tests/Feature/Helpers/CloudInitScriptTest.php
similarity index 100%
rename from tests/Feature/CloudInitScriptTest.php
rename to tests/Feature/Helpers/CloudInitScriptTest.php
diff --git a/tests/Feature/ConvertArraysTest.php b/tests/Feature/Helpers/ConvertArraysTest.php
similarity index 100%
rename from tests/Feature/ConvertArraysTest.php
rename to tests/Feature/Helpers/ConvertArraysTest.php
diff --git a/tests/Feature/ConvertingGitUrlsTest.php b/tests/Feature/Helpers/ConvertingGitUrlsTest.php
similarity index 100%
rename from tests/Feature/ConvertingGitUrlsTest.php
rename to tests/Feature/Helpers/ConvertingGitUrlsTest.php
diff --git a/tests/Feature/DockerCustomCommandsTest.php b/tests/Feature/Helpers/DockerCustomCommandsTest.php
similarity index 100%
rename from tests/Feature/DockerCustomCommandsTest.php
rename to tests/Feature/Helpers/DockerCustomCommandsTest.php
diff --git a/tests/Feature/Utf8HandlingTest.php b/tests/Feature/Helpers/Utf8HandlingTest.php
similarity index 97%
rename from tests/Feature/Utf8HandlingTest.php
rename to tests/Feature/Helpers/Utf8HandlingTest.php
index 50a52c5b2..6b100b067 100644
--- a/tests/Feature/Utf8HandlingTest.php
+++ b/tests/Feature/Helpers/Utf8HandlingTest.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Tests\Feature;
+namespace Tests\Feature\Helpers;
 
 use Tests\TestCase;
 
diff --git a/tests/Feature/CheckTraefikVersionJobTest.php b/tests/Feature/Jobs/CheckTraefikVersionJobTest.php
similarity index 94%
rename from tests/Feature/CheckTraefikVersionJobTest.php
rename to tests/Feature/Jobs/CheckTraefikVersionJobTest.php
index cee156485..86ebd8d16 100644
--- a/tests/Feature/CheckTraefikVersionJobTest.php
+++ b/tests/Feature/Jobs/CheckTraefikVersionJobTest.php
@@ -1,11 +1,15 @@
 <?php
 
+use App\Jobs\CheckTraefikVersionForServerJob;
 use App\Models\Server;
 use App\Models\Team;
 use App\Notifications\Server\TraefikVersionOutdated;
+use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Artisan;
 use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Schema;
 
 uses(RefreshDatabase::class);
 
@@ -14,7 +18,7 @@ beforeEach(function () {
 });
 
 it('detects servers table has detected_traefik_version column', function () {
-    expect(\Illuminate\Support\Facades\Schema::hasColumn('servers', 'detected_traefik_version'))->toBeTrue();
+    expect(Schema::hasColumn('servers', 'detected_traefik_version'))->toBeTrue();
 });
 
 it('server model casts detected_traefik_version as string', function () {
@@ -137,7 +141,7 @@ it('notification channels can be retrieved', function () {
 });
 
 it('traefik version check command exists', function () {
-    $commands = \Illuminate\Support\Facades\Artisan::all();
+    $commands = Artisan::all();
 
     expect($commands)->toHaveKey('traefik:check-version');
 });
@@ -181,16 +185,16 @@ it('groups servers by team correctly', function () {
 });
 
 it('server check job exists and has correct structure', function () {
-    expect(class_exists(\App\Jobs\CheckTraefikVersionForServerJob::class))->toBeTrue();
+    expect(class_exists(CheckTraefikVersionForServerJob::class))->toBeTrue();
 
     // Verify CheckTraefikVersionForServerJob has required properties
-    $reflection = new \ReflectionClass(\App\Jobs\CheckTraefikVersionForServerJob::class);
+    $reflection = new ReflectionClass(CheckTraefikVersionForServerJob::class);
     expect($reflection->hasProperty('tries'))->toBeTrue();
     expect($reflection->hasProperty('timeout'))->toBeTrue();
 
     // Verify it implements ShouldQueue
-    $interfaces = class_implements(\App\Jobs\CheckTraefikVersionForServerJob::class);
-    expect($interfaces)->toContain(\Illuminate\Contracts\Queue\ShouldQueue::class);
+    $interfaces = class_implements(CheckTraefikVersionForServerJob::class);
+    expect($interfaces)->toContain(ShouldQueue::class);
 });
 
 it('sends immediate notifications when outdated traefik is detected', function () {
diff --git a/tests/Feature/CleanupRedisTest.php b/tests/Feature/Jobs/CleanupRedisTest.php
similarity index 100%
rename from tests/Feature/CleanupRedisTest.php
rename to tests/Feature/Jobs/CleanupRedisTest.php
diff --git a/tests/Feature/Jobs/CoolifyTaskRetryTest.php b/tests/Feature/Jobs/CoolifyTaskRetryTest.php
new file mode 100644
index 000000000..8562319af
--- /dev/null
+++ b/tests/Feature/Jobs/CoolifyTaskRetryTest.php
@@ -0,0 +1,65 @@
+<?php
+
+use App\Enums\ProcessStatus;
+use App\Jobs\CoolifyTask;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $team = Team::factory()->create();
+    Server::factory()->create(['team_id' => $team->id]);
+
+    $this->activity = activity()
+        ->withProperties([
+            'server_uuid' => Server::first()->uuid,
+            'command' => 'echo "test"',
+            'type' => 'inline',
+            'status' => ProcessStatus::QUEUED->value,
+        ])
+        ->event('inline')
+        ->log('[]');
+
+    $this->job = new CoolifyTask(
+        activity: $this->activity,
+        ignore_errors: false,
+        call_event_on_finish: null,
+        call_event_data: null,
+    );
+});
+
+test('has correct retry configuration', function () {
+    expect($this->job->tries)->toBe(3)
+        ->and($this->job->maxExceptions)->toBe(1)
+        ->and($this->job->timeout)->toBe(600)
+        ->and($this->job->backoff())->toBe([30, 90, 180]);
+});
+
+test('is queued on the high priority queue', function () {
+    expect($this->job->queue)->toBe('high');
+});
+
+test('marks activity as error on permanent failure', function () {
+    $exception = new RuntimeException('SSH connection failed');
+
+    $this->job->failed($exception);
+
+    $this->activity->refresh();
+    $properties = $this->activity->properties;
+
+    expect($properties['status'])->toBe(ProcessStatus::ERROR->value)
+        ->and($properties['error'])->toBe('SSH connection failed')
+        ->and($properties)->toHaveKey('failed_at');
+});
+
+test('marks activity as error with default message when exception is null', function () {
+    $this->job->failed(null);
+
+    $this->activity->refresh();
+    $properties = $this->activity->properties;
+
+    expect($properties['status'])->toBe(ProcessStatus::ERROR->value)
+        ->and($properties['error'])->toBe('Job permanently failed');
+});
diff --git a/tests/Feature/DatabaseBackupJobTest.php b/tests/Feature/Jobs/DatabaseBackupJobTest.php
similarity index 100%
rename from tests/Feature/DatabaseBackupJobTest.php
rename to tests/Feature/Jobs/DatabaseBackupJobTest.php
diff --git a/tests/Feature/PushServerUpdateJobTest.php b/tests/Feature/Jobs/PushServerUpdateJobTest.php
similarity index 100%
rename from tests/Feature/PushServerUpdateJobTest.php
rename to tests/Feature/Jobs/PushServerUpdateJobTest.php
diff --git a/tests/Feature/ScheduledJobManagerStaleLockTest.php b/tests/Feature/Jobs/ScheduledJobManagerStaleLockTest.php
similarity index 100%
rename from tests/Feature/ScheduledJobManagerStaleLockTest.php
rename to tests/Feature/Jobs/ScheduledJobManagerStaleLockTest.php
diff --git a/tests/Feature/StartupExecutionCleanupTest.php b/tests/Feature/Jobs/StartupExecutionCleanupTest.php
similarity index 100%
rename from tests/Feature/StartupExecutionCleanupTest.php
rename to tests/Feature/Jobs/StartupExecutionCleanupTest.php
diff --git a/tests/Feature/LoginRateLimitIPTest.php b/tests/Feature/LoginRateLimitIPTest.php
deleted file mode 100644
index 6200870a1..000000000
--- a/tests/Feature/LoginRateLimitIPTest.php
+++ /dev/null
@@ -1,58 +0,0 @@
-<?php
-
-it('tests login rate limiting with different IPs like the Python script', function () {
-    // Create a test route that mimics login behavior
-    // We'll directly test the rate limiter behavior
-
-    $baseUrl = '/login';
-    $email = 'grumpinout+admin@wearehackerone.com';
-
-    // First, get a CSRF token by visiting the login page
-    $loginPageResponse = $this->get($baseUrl);
-    $loginPageResponse->assertSuccessful();
-
-    // Extract CSRF token using regex similar to Python script
-    preg_match('/name="_token"\s+value="([^"]+)"/', $loginPageResponse->getContent(), $matches);
-    $token = $matches[1] ?? null;
-
-    expect($token)->not->toBeNull('CSRF token should be found');
-
-    // Test 14 login attempts with different IPs (like the Python script does 1-14)
-    $results = [];
-    for ($i = 1; $i <= 14; $i++) {
-        $spoofedIp = "198.51.100.{$i}";
-
-        $response = $this->withHeader('X-Forwarded-For', $spoofedIp)
-            ->post($baseUrl, [
-                '_token' => $token,
-                'email' => $email,
-                'password' => "WrongPass{$i}!",
-            ]);
-
-        $statusCode = $response->getStatusCode();
-        $rateLimitLimit = $response->headers->get('X-RateLimit-Limit');
-        $rateLimitRemaining = $response->headers->get('X-RateLimit-Remaining');
-
-        $results[$i] = [
-            'ip' => $spoofedIp,
-            'status' => $statusCode,
-            'rate_limit' => $rateLimitLimit,
-            'rate_limit_remaining' => $rateLimitRemaining,
-        ];
-
-        // Print output similar to Python script
-        echo 'Attempt '.str_pad($i, 2, '0', STR_PAD_LEFT).": status=$statusCode, RL=$rateLimitLimit/$rateLimitRemaining\n";
-
-        // Add a small delay like the Python script (0.2 seconds)
-        usleep(200000);
-    }
-
-    // Verify results
-    expect($results)->toHaveCount(14);
-
-    // Check that we got responses for all attempts
-    foreach ($results as $i => $result) {
-        expect($result['status'])->toBeGreaterThanOrEqual(200);
-        expect($result['ip'])->toBe("198.51.100.{$i}");
-    }
-});
diff --git a/tests/Feature/Mcp/McpEndpointTest.php b/tests/Feature/Mcp/McpEndpointTest.php
index ae0101547..b8511afef 100644
--- a/tests/Feature/Mcp/McpEndpointTest.php
+++ b/tests/Feature/Mcp/McpEndpointTest.php
@@ -6,6 +6,7 @@ use App\Models\Server;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Once;
 
 uses(RefreshDatabase::class);
@@ -64,6 +65,23 @@ function mcpToolJson($response): array
     return json_decode($response->json('result.content.0.text'), true);
 }
 
+function expectMcpAuditLog(array $expected): void
+{
+    $auditChannel = Mockery::mock();
+
+    Log::shouldReceive('channel')
+        ->with('audit')
+        ->once()
+        ->andReturn($auditChannel);
+
+    $auditChannel
+        ->shouldReceive('info')
+        ->once()
+        ->with('mcp.tool.called', Mockery::on(fn (array $context) => collect($expected)->every(
+            fn ($value, $key) => data_get($context, $key) === $value,
+        )));
+}
+
 test('MCP endpoint returns 404 when the instance setting is disabled', function () {
     InstanceSettings::query()->where('id', 0)->update(['is_mcp_server_enabled' => false]);
     Once::flush();
@@ -193,6 +211,48 @@ test('tool calls fail when the token lacks the read ability', function () {
     expect($response->json('result.content.0.text'))->toContain('Missing required permissions');
 });
 
+test('MCP tools audit successful execution with the actual tool name', function () {
+    Project::create(['name' => 'Mine', 'team_id' => $this->team->id]);
+    $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+    expectMcpAuditLog([
+        'tool' => 'list_projects',
+        'team_id' => $this->team->id,
+        'outcome' => 'success',
+    ]);
+
+    mcpCallTool($token, 'list_projects')->assertOk();
+});
+
+test('MCP tools audit denied execution after ability checks', function () {
+    $token = $this->user->createToken('mcp-no-abilities', [])->plainTextToken;
+
+    expectMcpAuditLog([
+        'tool' => 'list_projects',
+        'team_id' => $this->team->id,
+        'outcome' => 'denied',
+    ]);
+
+    $response = mcpCallTool($token, 'list_projects');
+    $response->assertOk();
+    expect($response->json('result.isError'))->toBeTrue();
+});
+
+test('MCP tools audit execution errors after tool handling', function () {
+    $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+    expectMcpAuditLog([
+        'tool' => 'get_server',
+        'team_id' => $this->team->id,
+        'outcome' => 'error',
+        'resource_uuid' => 'missing-server',
+    ]);
+
+    $response = mcpCallTool($token, 'get_server', ['uuid' => 'missing-server']);
+    $response->assertOk();
+    expect($response->json('result.isError'))->toBeTrue();
+});
+
 test('MCP rejects token when user no longer belongs to token team', function () {
     Project::create(['name' => 'Hidden', 'team_id' => $this->team->id]);
     $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
diff --git a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
new file mode 100644
index 000000000..962628298
--- /dev/null
+++ b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('keeps mutable Livewire components behind authorization checks', function (string $path, array $requiredNeedles) {
+    $source = file_get_contents(base_path($path));
+
+    foreach ($requiredNeedles as $needle) {
+        expect($source)->toContain($needle);
+    }
+})->with([
+    'storage resources' => [
+        'app/Livewire/Storage/Resources.php',
+        ['AuthorizesRequests', "authorize('update'", "authorize('view'"],
+    ],
+    'postgres init script editor' => [
+        'app/Livewire/Project/Database/InitScript.php',
+        ['AuthorizesRequests', "authorize('update'"],
+    ],
+    'execute container command' => [
+        'app/Livewire/Project/Shared/ExecuteContainerCommand.php',
+        ['AuthorizesRequests', "authorize('view'", "authorize('canAccessTerminal'"],
+    ],
+    'terminal' => [
+        'app/Livewire/Project/Shared/Terminal.php',
+        ['AuthorizesRequests', "authorize('view'", "authorize('canAccessTerminal'"],
+    ],
+]);
diff --git a/tests/Feature/Proxy/RestartProxyTest.php b/tests/Feature/Proxy/RestartProxyTest.php
index 5771a58f7..f4bad63eb 100644
--- a/tests/Feature/Proxy/RestartProxyTest.php
+++ b/tests/Feature/Proxy/RestartProxyTest.php
@@ -1,139 +1,91 @@
 <?php
 
-namespace Tests\Feature\Proxy;
-
-use App\Jobs\RestartProxyJob;
+use App\Enums\ProxyTypes;
+use App\Models\InstanceSettings;
 use App\Models\Server;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\Queue;
 use Livewire\Livewire;
-use Tests\TestCase;
 
-class RestartProxyTest extends TestCase
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::create(['id' => 0]);
+});
+
+function setupProxyUser(string $role): array
 {
-    use RefreshDatabase;
+    $team = Team::factory()->create();
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => $role]);
 
-    protected User $user;
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'name' => 'Test Server',
+        'ip' => '192.168.1.100',
+    ]);
 
-    protected Team $team;
-
-    protected Server $server;
-
-    protected function setUp(): void
-    {
-        parent::setUp();
-
-        // Create test user and team
-        $this->user = User::factory()->create();
-        $this->team = Team::factory()->create(['name' => 'Test Team']);
-        $this->user->teams()->attach($this->team);
-
-        // Create test server
-        $this->server = Server::factory()->create([
-            'team_id' => $this->team->id,
-            'name' => 'Test Server',
-            'ip' => '192.168.1.100',
-        ]);
-
-        // Authenticate user
-        $this->actingAs($this->user);
-    }
-
-    public function test_restart_dispatches_job_for_all_servers()
-    {
-        Queue::fake();
-
-        Livewire::test('server.navbar', ['server' => $this->server])
-            ->call('restart');
-
-        // Assert job was dispatched
-        Queue::assertPushed(RestartProxyJob::class, function ($job) {
-            return $job->server->id === $this->server->id;
-        });
-    }
-
-    public function test_restart_dispatches_job_for_localhost_server()
-    {
-        Queue::fake();
-
-        // Create localhost server (id = 0)
-        $localhostServer = Server::factory()->create([
-            'id' => 0,
-            'team_id' => $this->team->id,
-            'name' => 'Localhost',
-            'ip' => 'host.docker.internal',
-        ]);
-
-        Livewire::test('server.navbar', ['server' => $localhostServer])
-            ->call('restart');
-
-        // Assert job was dispatched
-        Queue::assertPushed(RestartProxyJob::class, function ($job) use ($localhostServer) {
-            return $job->server->id === $localhostServer->id;
-        });
-    }
-
-    public function test_restart_shows_info_message()
-    {
-        Queue::fake();
-
-        Livewire::test('server.navbar', ['server' => $this->server])
-            ->call('restart')
-            ->assertDispatched('info', 'Proxy restart initiated. Monitor progress in activity logs.');
-    }
-
-    public function test_unauthorized_user_cannot_restart_proxy()
-    {
-        Queue::fake();
-
-        // Create another user without access
-        $unauthorizedUser = User::factory()->create();
-        $this->actingAs($unauthorizedUser);
-
-        Livewire::test('server.navbar', ['server' => $this->server])
-            ->call('restart')
-            ->assertForbidden();
-
-        // Assert job was NOT dispatched
-        Queue::assertNotPushed(RestartProxyJob::class);
-    }
-
-    public function test_restart_prevents_concurrent_jobs_via_without_overlapping()
-    {
-        Queue::fake();
-
-        // Dispatch job twice
-        Livewire::test('server.navbar', ['server' => $this->server])
-            ->call('restart');
-
-        Livewire::test('server.navbar', ['server' => $this->server])
-            ->call('restart');
-
-        // Assert job was pushed twice (WithoutOverlapping middleware will handle deduplication)
-        Queue::assertPushed(RestartProxyJob::class, 2);
-
-        // Get the jobs
-        $jobs = Queue::pushed(RestartProxyJob::class);
-
-        // Verify both jobs have WithoutOverlapping middleware
-        foreach ($jobs as $job) {
-            $middleware = $job['job']->middleware();
-            $this->assertCount(1, $middleware);
-            $this->assertInstanceOf(\Illuminate\Queue\Middleware\WithoutOverlapping::class, $middleware[0]);
-        }
-    }
-
-    public function test_restart_uses_server_team_id()
-    {
-        Queue::fake();
-
-        Livewire::test('server.navbar', ['server' => $this->server])
-            ->call('restart');
-
-        Queue::assertPushed(RestartProxyJob::class, function ($job) {
-            return $job->server->team_id === $this->team->id;
-        });
-    }
+    return [$user, $team, $server];
 }
+
+function makeServerProxyRunning(Server $server): void
+{
+    $server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+    $server->proxy->status = 'running';
+    $server->proxy->type = ProxyTypes::TRAEFIK->value;
+    $server->save();
+    $server->refresh();
+}
+
+test('member cannot see proxy restart and stop buttons', function () {
+    [$user, $team, $server] = setupProxyUser('member');
+    makeServerProxyRunning($server);
+
+    // Mock proxySet to bypass SQLite boolean casting issue with force_disabled
+    $mock = Mockery::mock($server)->makePartial();
+    $mock->shouldReceive('proxySet')->andReturn(true);
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    Livewire::test('server.navbar', ['server' => $mock])
+        ->assertDontSee('Restart Proxy')
+        ->assertDontSee('Stop Proxy');
+});
+
+test('admin can see proxy restart and stop buttons', function () {
+    [$user, $team, $server] = setupProxyUser('admin');
+    makeServerProxyRunning($server);
+
+    $mock = Mockery::mock($server)->makePartial();
+    $mock->shouldReceive('proxySet')->andReturn(true);
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    Livewire::test('server.navbar', ['server' => $mock])
+        ->assertSee('Restart Proxy')
+        ->assertSee('Stop Proxy');
+});
+
+test('member cannot see start proxy button', function () {
+    [$user, $team, $server] = setupProxyUser('member');
+
+    $server->proxy->status = 'exited';
+    $server->proxy->type = ProxyTypes::TRAEFIK->value;
+    $server->save();
+    $server->refresh();
+
+    $mock = Mockery::mock($server)->makePartial();
+    $mock->shouldReceive('proxySet')->andReturn(true);
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    Livewire::test('server.navbar', ['server' => $mock])
+        ->assertDontSee('Start Proxy');
+});
diff --git a/tests/Feature/ResourceDetailsVisibilityTest.php b/tests/Feature/ResourceDetailsVisibilityTest.php
new file mode 100644
index 000000000..762683447
--- /dev/null
+++ b/tests/Feature/ResourceDetailsVisibilityTest.php
@@ -0,0 +1,46 @@
+<?php
+
+use Illuminate\Support\Facades\Blade;
+use Illuminate\Support\MessageBag;
+use Illuminate\Support\ViewErrorBag;
+
+beforeEach(function () {
+    $errors = new ViewErrorBag;
+    $errors->put('default', new MessageBag);
+    view()->share('errors', $errors);
+});
+
+it('keeps the resource details helper text visible below the modal header', function () {
+    $html = view('livewire.project.shared.resource-details', [
+        'resource' => (object) [
+            'name' => 'Crash Loop Example',
+            'uuid' => 'crashloop',
+        ],
+        'environment_uuid' => null,
+        'environment_name' => null,
+        'project_uuid' => null,
+        'project_name' => null,
+        'server_uuid' => null,
+        'server_name' => null,
+        'stack_applications' => [],
+        'stack_databases' => [],
+    ])->render();
+
+    expect($html)
+        ->toContain('Identifiers for this resource. Read-only')
+        ->toContain('pt-1')
+        ->not->toContain('-mt-4');
+});
+
+it('renders copy fields as visible readonly controls with an accessible copy action', function () {
+    $html = Blade::render('<x-forms.copy-button label="UUID" text="crashloop" />');
+
+    expect($html)
+        ->toContain('label class="flex gap-1 items-center mb-1 text-sm font-medium text-black dark:text-white"')
+        ->toContain('readonly')
+        ->toContain('class="input pr-11 bg-white dark:bg-coolgray-100 dark:read-only:bg-coolgray-100 dark:read-only:text-white"')
+        ->toContain('aria-label="Copy to clipboard"')
+        ->toContain('title="Copy to clipboard"')
+        ->toContain('rounded-sm p-1.5 text-neutral-500 transition-colors hover:text-neutral-700 focus-visible:ring-2 focus-visible:ring-coollabs focus-visible:ring-offset-2 dark:text-neutral-400 dark:hover:text-white dark:focus-visible:ring-warning dark:focus-visible:ring-offset-base')
+        ->toContain('class="w-5 h-5 text-green-500"');
+});
diff --git a/tests/Feature/ResourcePermissionCalloutTest.php b/tests/Feature/ResourcePermissionCalloutTest.php
new file mode 100644
index 000000000..36e8100c7
--- /dev/null
+++ b/tests/Feature/ResourcePermissionCalloutTest.php
@@ -0,0 +1,82 @@
+<?php
+
+use App\Livewire\Project\Shared\ResourceOperations;
+use App\Livewire\Project\Shared\Tags;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function resourcePermissionCalloutApplicationFor(string $role): Application
+{
+    $user = User::factory()->create();
+    $team = Team::factory()->create();
+    $user->teams()->attach($team, ['role' => $role]);
+
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    test()->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    return Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+}
+
+it('shows one red insufficient permissions callout for resource operations when update is denied', function () {
+    $application = resourcePermissionCalloutApplicationFor('member');
+
+    $component = Livewire::test(ResourceOperations::class, ['resource' => $application])
+        ->assertSee('Insufficient Permissions')
+        ->assertSee('permission to modify this resource')
+        ->assertSee('team administrator for access')
+        ->assertDontSee('Access Restricted')
+        ->assertDontSee("You don't have permission to clone resources")
+        ->assertDontSee("You don't have permission to move resources");
+
+    expect(substr_count($component->html(), 'Insufficient Permissions'))->toBe(1)
+        ->and($component->html())->toContain('bg-red-50')
+        ->and($component->html())->not->toContain('bg-warning-50');
+});
+
+it('shows the red insufficient permissions callout for tags when update is denied', function () {
+    $application = resourcePermissionCalloutApplicationFor('member');
+
+    $component = Livewire::test(Tags::class, ['resource' => $application])
+        ->assertSee('Insufficient Permissions')
+        ->assertSee('permission to manage this resource')
+        ->assertSee('team administrator for access')
+        ->assertDontSee('Access Restricted')
+        ->assertDontSee("You don't have permission to manage tags");
+
+    expect(substr_count($component->html(), 'Insufficient Permissions'))->toBe(1)
+        ->and($component->html())->toContain('bg-red-50')
+        ->and($component->html())->not->toContain('bg-warning-50');
+});
+
+it('does not use yellow permission callouts in blade views', function () {
+    $offendingFiles = collect(new RecursiveIteratorIterator(new RecursiveDirectoryIterator(resource_path('views'))))
+        ->filter(fn (SplFileInfo $file) => $file->isFile() && $file->getExtension() === 'php')
+        ->filter(function (SplFileInfo $file) {
+            $contents = file_get_contents($file->getPathname());
+
+            return str_contains($contents, 'type="warning" title="Permission Required"')
+                || str_contains($contents, 'title="Access Restricted"');
+        })
+        ->map(fn (SplFileInfo $file) => str_replace(base_path().'/', '', $file->getPathname()))
+        ->values()
+        ->all();
+
+    expect($offendingFiles)->toBeEmpty();
+});
diff --git a/tests/Feature/ResponsiveCheckboxLayoutTest.php b/tests/Feature/ResponsiveCheckboxLayoutTest.php
index a044b79a6..9cbce97c9 100644
--- a/tests/Feature/ResponsiveCheckboxLayoutTest.php
+++ b/tests/Feature/ResponsiveCheckboxLayoutTest.php
@@ -92,11 +92,11 @@ it('renders responsive checkbox classes on the application configuration page',
     $response->assertSee('<optgroup label="Application">', false);
     $response->assertSee('<optgroup label="Configuration">', false);
     $response->assertSee('<optgroup label="Links">', false);
-    $response->assertSee('<optgroup label="Actions">', false);
+    $response->assertSee('application-mobile-actions');
+    $response->assertDontSee('<optgroup label="Actions">', false);
     $response->assertSee('value="navigate|application|', false);
     $response->assertSee('value="navigate|configuration|', false);
     $response->assertSee('window.Livewire?.navigate ? window.Livewire.navigate(url) : window.location.href = url', false);
-    $response->assertSee('value="action:force-deploy"', false);
     $response->assertSee('application-mobile-stop-trigger');
     $response->assertSee('application-mobile-deploy-trigger');
     $response->assertSee('application-mobile-restart-trigger');
diff --git a/tests/Feature/S3StoragePolicyRegistrationTest.php b/tests/Feature/S3StoragePolicyRegistrationTest.php
new file mode 100644
index 000000000..f75c58a85
--- /dev/null
+++ b/tests/Feature/S3StoragePolicyRegistrationTest.php
@@ -0,0 +1,54 @@
+<?php
+
+use App\Models\S3Storage;
+use App\Models\Team;
+use App\Models\User;
+use App\Policies\S3StoragePolicy;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Gate;
+
+uses(RefreshDatabase::class);
+
+test('s3 storage model resolves its registered policy through the gate', function () {
+    expect(Gate::getPolicyFor(S3Storage::class))->toBeInstanceOf(S3StoragePolicy::class);
+});
+
+test('s3 storage create ability is enforced through the registered policy', function () {
+    $team = Team::factory()->create();
+
+    $admin = User::factory()->create();
+    $admin->teams()->attach($team, ['role' => 'admin']);
+
+    $member = User::factory()->create();
+    $member->teams()->attach($team, ['role' => 'member']);
+
+    $this->actingAs($admin);
+    session(['currentTeam' => $team]);
+
+    expect($admin->can('create', S3Storage::class))->toBeTrue()
+        ->and($member->can('create', S3Storage::class))->toBeFalse();
+});
+
+test('s3 storage validate connection ability is enforced through the registered policy', function () {
+    $team = Team::factory()->create();
+
+    $admin = User::factory()->create();
+    $admin->teams()->attach($team, ['role' => 'admin']);
+
+    $member = User::factory()->create();
+    $member->teams()->attach($team, ['role' => 'member']);
+
+    $storage = S3Storage::create([
+        'team_id' => $team->id,
+        'name' => 'Backups',
+        'description' => 'Team backup storage',
+        'region' => 'us-east-1',
+        'key' => 'access-key',
+        'secret' => 'secret-key',
+        'bucket' => 'coolify-backups',
+        'endpoint' => 'https://s3.us-east-1.amazonaws.com',
+    ]);
+
+    expect($admin->can('validateConnection', $storage))->toBeTrue()
+        ->and($member->can('validateConnection', $storage))->toBeFalse();
+});
diff --git a/tests/Feature/Security/ApiTokenCreationSecurityTest.php b/tests/Feature/Security/ApiTokenCreationSecurityTest.php
new file mode 100644
index 000000000..0e5d363de
--- /dev/null
+++ b/tests/Feature/Security/ApiTokenCreationSecurityTest.php
@@ -0,0 +1,166 @@
+<?php
+
+use App\Livewire\Security\ApiTokens;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0], ['is_api_enabled' => true]);
+
+    $this->team = Team::factory()->create();
+
+    $this->owner = User::factory()->create();
+    $this->owner->teams()->attach($this->team, ['role' => 'owner']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+});
+
+describe('Livewire ApiTokens — member cannot create elevated tokens', function () {
+    test('member cannot create token with root permissions', function () {
+        $this->actingAs($this->member);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'my-root-token')
+            ->set('permissions', ['root'])
+            ->call('addNewToken')
+            ->assertDispatched('error');
+
+        expect($this->member->tokens()->count())->toBe(0);
+    });
+
+    test('member cannot create token with write permissions', function () {
+        $this->actingAs($this->member);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'my-write-token')
+            ->set('permissions', ['write'])
+            ->call('addNewToken')
+            ->assertDispatched('error');
+
+        expect($this->member->tokens()->count())->toBe(0);
+    });
+
+    test('member cannot create token with deploy permissions', function () {
+        $this->actingAs($this->member);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'my-deploy-token')
+            ->set('permissions', ['deploy'])
+            ->call('addNewToken')
+            ->assertDispatched('error');
+
+        expect($this->member->tokens()->count())->toBe(0);
+    });
+
+    test('member cannot create token with read:sensitive permissions', function () {
+        $this->actingAs($this->member);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'my-sensitive-token')
+            ->set('permissions', ['read', 'read:sensitive'])
+            ->call('addNewToken')
+            ->assertDispatched('error');
+
+        expect($this->member->tokens()->count())->toBe(0);
+    });
+
+    test('member cannot bypass by setting canUseRootPermissions property', function () {
+        $this->actingAs($this->member);
+        session(['currentTeam' => $this->team]);
+
+        // Simulate snapshot replay: force the boolean to true
+        Livewire::test(ApiTokens::class)
+            ->set('canUseRootPermissions', true)
+            ->set('description', 'sneaky-root-token')
+            ->set('permissions', ['root'])
+            ->call('addNewToken')
+            ->assertDispatched('error');
+
+        expect($this->member->tokens()->count())->toBe(0);
+    });
+
+    test('member can create token with read permissions', function () {
+        $this->actingAs($this->member);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'my-read-token')
+            ->set('permissions', ['read'])
+            ->call('addNewToken')
+            ->assertNotDispatched('error');
+
+        expect($this->member->tokens()->count())->toBe(1);
+        expect($this->member->tokens()->first()->abilities)->toBe(['read']);
+    });
+
+    test('owner can create token with root permissions', function () {
+        $this->actingAs($this->owner);
+        session(['currentTeam' => $this->team]);
+
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'my-root-token')
+            ->set('permissions', ['root'])
+            ->call('addNewToken')
+            ->assertNotDispatched('error');
+
+        expect($this->owner->tokens()->count())->toBe(1);
+        expect($this->owner->tokens()->first()->abilities)->toBe(['root']);
+    });
+});
+
+describe('ApiAbility middleware — member with elevated token blocked', function () {
+    test('member root token is blocked on team_id=0 (root team)', function () {
+        // Create root team with id=0
+        $rootTeam = Team::factory()->create(['id' => 0]);
+        $member = User::factory()->create();
+        $rootTeam->members()->attach($member->id, ['role' => 'member']);
+
+        session(['currentTeam' => $rootTeam]);
+        $token = $member->createToken('root-token', ['root']);
+
+        $this->withToken($token->plainTextToken)
+            ->getJson('/api/v1/projects')
+            ->assertStatus(403);
+    });
+
+    test('admin root token passes on team_id=0 (root team)', function () {
+        $rootTeam = Team::factory()->create(['id' => 0]);
+        $admin = User::factory()->create();
+        $rootTeam->members()->attach($admin->id, ['role' => 'admin']);
+
+        session(['currentTeam' => $rootTeam]);
+        $token = $admin->createToken('root-token', ['root']);
+
+        $this->withToken($token->plainTextToken)
+            ->getJson('/api/v1/projects')
+            ->assertSuccessful();
+    });
+
+    test('member root token is blocked on non-zero team', function () {
+        session(['currentTeam' => $this->team]);
+        $token = $this->member->createToken('root-token', ['root']);
+
+        $this->withToken($token->plainTextToken)
+            ->getJson('/api/v1/projects')
+            ->assertStatus(403);
+    });
+
+    test('member read token passes on non-zero team', function () {
+        session(['currentTeam' => $this->team]);
+        $token = $this->member->createToken('read-token', ['read']);
+
+        $this->withToken($token->plainTextToken)
+            ->getJson('/api/v1/projects')
+            ->assertSuccessful();
+    });
+});
diff --git a/tests/Feature/Security/AuditLogTest.php b/tests/Feature/Security/AuditLogTest.php
index 34e9168ec..ca1b7bd08 100644
--- a/tests/Feature/Security/AuditLogTest.php
+++ b/tests/Feature/Security/AuditLogTest.php
@@ -1,19 +1,36 @@
 <?php
 
+use App\Livewire\Security\CloudInitScriptForm;
+use App\Livewire\Security\CloudInitScripts;
+use App\Livewire\Security\CloudProviderTokenForm;
+use App\Livewire\Security\CloudProviderTokens;
 use App\Models\Application;
+use App\Models\CloudInitScript;
+use App\Models\CloudProviderToken;
 use App\Models\Environment;
+use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 function makeAuditTeamUser(): array
 {
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+    Once::flush();
+
     $team = Team::factory()->create();
     $user = User::factory()->create();
     $team->members()->attach($user->id, ['role' => 'owner']);
@@ -122,6 +139,89 @@ describe('audit channel helper', function () {
     });
 });
 
+describe('security UI audit logging', function () {
+    test('creating a cloud provider token from Livewire writes an audit entry', function () {
+        [$team] = makeAuditTeamUser();
+
+        Http::fake([
+            'https://api.hetzner.cloud/v1/servers' => Http::response([], 200),
+        ]);
+
+        $auditChannel = Mockery::mock();
+        $auditChannel->shouldReceive('info')
+            ->once()
+            ->with('ui.cloud_token.created', Mockery::on(function (array $context) use ($team) {
+                return $context['team_id'] === $team->id
+                    && $context['provider'] === 'hetzner'
+                    && $context['cloud_token_name'] === 'UI Token';
+            }));
+
+        Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+
+        Livewire::test(CloudProviderTokenForm::class)
+            ->set('provider', 'hetzner')
+            ->set('token', 'secret-token')
+            ->set('name', 'UI Token')
+            ->call('addToken');
+    });
+
+    test('deleting a cloud provider token from Livewire writes an audit entry', function () {
+        [$team] = makeAuditTeamUser();
+        $token = CloudProviderToken::factory()->create([
+            'team_id' => $team->id,
+            'provider' => 'hetzner',
+            'name' => 'Delete Me',
+        ]);
+
+        $auditChannel = Mockery::mock();
+        $auditChannel->shouldReceive('info')
+            ->once()
+            ->with('ui.cloud_token.deleted', Mockery::on(function (array $context) use ($token) {
+                return $context['cloud_token_uuid'] === $token->uuid
+                    && $context['cloud_token_name'] === 'Delete Me';
+            }));
+
+        Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+
+        Livewire::test(CloudProviderTokens::class)
+            ->call('deleteToken', $token->id);
+    });
+
+    test('creating and deleting cloud-init scripts from Livewire write audit entries', function () {
+        [$team] = makeAuditTeamUser();
+
+        $auditChannel = Mockery::mock();
+        $auditChannel->shouldReceive('info')
+            ->once()
+            ->with('ui.cloud_init_script.created', Mockery::on(function (array $context) use ($team) {
+                return $context['team_id'] === $team->id
+                    && $context['cloud_init_script_name'] === 'Bootstrap';
+            }));
+        $auditChannel->shouldReceive('info')
+            ->once()
+            ->with('ui.cloud_init_script.deleted', Mockery::on(function (array $context) {
+                return $context['cloud_init_script_name'] === 'Bootstrap';
+            }));
+
+        Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+
+        Livewire::test(CloudInitScriptForm::class)
+            ->set('name', 'Bootstrap')
+            ->set('script', "#cloud-config\npackages: []")
+            ->call('save');
+
+        $script = CloudInitScript::where('team_id', $team->id)->firstOrFail();
+
+        Livewire::test(CloudInitScripts::class)
+            ->call('deleteScript', $script->id);
+    });
+
+    test('cloud provider token form does not contain debug ray calls', function () {
+        expect(file_get_contents(app_path('Livewire/Security/CloudProviderTokenForm.php')))
+            ->not->toContain('ray(');
+    });
+});
+
 describe('webhook signature failure logging', function () {
     test('GitHub manual webhook with bad signature logs to audit channel', function () {
         $app = makeAuditApplication();
diff --git a/tests/Feature/CaCertificateCommandInjectionTest.php b/tests/Feature/Security/CaCertificateCommandInjectionTest.php
similarity index 100%
rename from tests/Feature/CaCertificateCommandInjectionTest.php
rename to tests/Feature/Security/CaCertificateCommandInjectionTest.php
diff --git a/tests/Feature/CmdHealthCheckValidationTest.php b/tests/Feature/Security/CmdHealthCheckValidationTest.php
similarity index 100%
rename from tests/Feature/CmdHealthCheckValidationTest.php
rename to tests/Feature/Security/CmdHealthCheckValidationTest.php
diff --git a/tests/Feature/CommandInjectionSecurityTest.php b/tests/Feature/Security/CommandInjectionSecurityTest.php
similarity index 100%
rename from tests/Feature/CommandInjectionSecurityTest.php
rename to tests/Feature/Security/CommandInjectionSecurityTest.php
diff --git a/tests/Feature/IpAllowlistTest.php b/tests/Feature/Security/IpAllowlistTest.php
similarity index 99%
rename from tests/Feature/IpAllowlistTest.php
rename to tests/Feature/Security/IpAllowlistTest.php
index 1b14b79e8..a95f1566b 100644
--- a/tests/Feature/IpAllowlistTest.php
+++ b/tests/Feature/Security/IpAllowlistTest.php
@@ -1,5 +1,7 @@
 <?php
 
+use App\Rules\ValidIpOrCidr;
+
 test('IP allowlist with single IPs', function () {
     $testCases = [
         ['ip' => '192.168.1.100', 'allowlist' => ['192.168.1.100'], 'expected' => true],
@@ -200,7 +202,7 @@ test('IP allowlist comma-separated string input', function () {
 });
 
 test('ValidIpOrCidr validation rule', function () {
-    $rule = new \App\Rules\ValidIpOrCidr;
+    $rule = new ValidIpOrCidr;
 
     // Helper function to test validation
     $validate = function ($value) use ($rule) {
@@ -248,7 +250,7 @@ test('ValidIpOrCidr validation rule', function () {
 });
 
 test('ValidIpOrCidr validation rule error messages', function () {
-    $rule = new \App\Rules\ValidIpOrCidr;
+    $rule = new ValidIpOrCidr;
 
     // Helper function to get error message
     $getError = function ($value) use ($rule) {
diff --git a/tests/Feature/Security/TrustHostsMiddlewareTest.php b/tests/Feature/Security/TrustHostsMiddlewareTest.php
new file mode 100644
index 000000000..9a44be14b
--- /dev/null
+++ b/tests/Feature/Security/TrustHostsMiddlewareTest.php
@@ -0,0 +1,361 @@
+<?php
+
+use App\Http\Middleware\TrustHosts;
+use App\Models\InstanceSettings;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    // Clear cache before each test to ensure isolation
+    Cache::forget('instance_settings_fqdn_host');
+});
+
+it('trusts the configured FQDN from InstanceSettings', function () {
+    // Create instance settings with FQDN
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'https://coolify.example.com']
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    expect($hosts)->toContain('coolify.example.com');
+});
+
+it('rejects password reset request with malicious host header', function () {
+    // Set up instance settings with legitimate FQDN
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'https://coolify.example.com']
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    // The malicious host should NOT be in the trusted hosts
+    expect($hosts)->not->toContain('coolify.example.com.evil.com');
+    expect($hosts)->toContain('coolify.example.com');
+});
+
+it('handles missing FQDN gracefully', function () {
+    // Create instance settings without FQDN
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => null]
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    // Should still return APP_URL pattern without throwing
+    expect($hosts)->not->toBeEmpty();
+});
+
+it('filters out null and empty values from trusted hosts', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => '']
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    // Should not contain empty strings or null
+    foreach ($hosts as $host) {
+        if ($host !== null) {
+            expect($host)->not->toBeEmpty();
+        }
+    }
+});
+
+it('extracts host from FQDN with protocol and port', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'https://coolify.example.com:8443']
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    expect($hosts)->toContain('coolify.example.com');
+});
+
+it('handles exception during InstanceSettings fetch', function () {
+    // Drop the instance_settings table to simulate installation
+    Schema::dropIfExists('instance_settings');
+
+    $middleware = new TrustHosts($this->app);
+
+    // Should not throw an exception
+    $hosts = $middleware->hosts();
+
+    expect($hosts)->not->toBeEmpty();
+});
+
+it('trusts IP addresses with port', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'http://65.21.3.91:8000']
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    expect($hosts)->toContain('65.21.3.91');
+});
+
+it('trusts IP addresses without port', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'http://192.168.1.100']
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    expect($hosts)->toContain('192.168.1.100');
+});
+
+it('rejects malicious host when using IP address', function () {
+    // Simulate an instance using IP address
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'http://65.21.3.91:8000']
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    // The malicious host attempting to mimic the IP should NOT be trusted
+    expect($hosts)->not->toContain('65.21.3.91.evil.com');
+    expect($hosts)->not->toContain('evil.com');
+    expect($hosts)->toContain('65.21.3.91');
+});
+
+it('trusts IPv6 addresses', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'http://[2001:db8::1]:8000']
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    // IPv6 addresses are enclosed in brackets, getHost() should handle this
+    expect($hosts)->toContain('[2001:db8::1]');
+});
+
+it('invalidates cache when FQDN is updated', function () {
+    // Set initial FQDN
+    $settings = InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'https://old-domain.com']
+    );
+
+    // First call should cache it
+    $middleware = new TrustHosts($this->app);
+    $hosts1 = $middleware->hosts();
+    expect($hosts1)->toContain('old-domain.com');
+
+    // Verify cache exists
+    expect(Cache::has('instance_settings_fqdn_host'))->toBeTrue();
+
+    // Update FQDN - should trigger cache invalidation
+    $settings->fqdn = 'https://new-domain.com';
+    $settings->save();
+
+    // Cache should be cleared
+    expect(Cache::has('instance_settings_fqdn_host'))->toBeFalse();
+
+    // New call should return updated host
+    $middleware2 = new TrustHosts($this->app);
+    $hosts2 = $middleware2->hosts();
+    expect($hosts2)->toContain('new-domain.com');
+    expect($hosts2)->not->toContain('old-domain.com');
+});
+
+it('caches trusted hosts to avoid database queries on every request', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'https://coolify.example.com']
+    );
+
+    // Clear cache first
+    Cache::forget('instance_settings_fqdn_host');
+
+    // First call - should query database and cache result
+    $middleware1 = new TrustHosts($this->app);
+    $hosts1 = $middleware1->hosts();
+
+    // Verify result is cached
+    expect(Cache::has('instance_settings_fqdn_host'))->toBeTrue();
+    expect(Cache::get('instance_settings_fqdn_host'))->toBe('coolify.example.com');
+
+    // Subsequent calls should use cache (no DB query)
+    $middleware2 = new TrustHosts($this->app);
+    $hosts2 = $middleware2->hosts();
+
+    expect($hosts1)->toBe($hosts2);
+    expect($hosts2)->toContain('coolify.example.com');
+});
+
+it('caches negative results when no FQDN is configured', function () {
+    // Create instance settings without FQDN
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => null]
+    );
+
+    // Clear cache first
+    Cache::forget('instance_settings_fqdn_host');
+
+    // First call - should query database and cache empty string sentinel
+    $middleware1 = new TrustHosts($this->app);
+    $hosts1 = $middleware1->hosts();
+
+    // Verify empty string sentinel is cached (not null, which wouldn't be cached)
+    expect(Cache::has('instance_settings_fqdn_host'))->toBeTrue();
+    expect(Cache::get('instance_settings_fqdn_host'))->toBe('');
+
+    // Subsequent calls should use cached sentinel value
+    $middleware2 = new TrustHosts($this->app);
+    $hosts2 = $middleware2->hosts();
+
+    expect($hosts1)->toBe($hosts2);
+    // Should only contain APP_URL pattern, not any FQDN
+    expect($hosts2)->not->toBeEmpty();
+});
+
+it('skips host validation for terminal auth routes', function () {
+    // These routes should be accessible with any Host header (for internal container communication)
+    $response = $this->postJson('/terminal/auth', [], [
+        'Host' => 'coolify:8080',  // Internal Docker host
+    ]);
+
+    // Should not get 400 Bad Host (might get 401 Unauthorized instead)
+    expect($response->status())->not->toBe(400);
+});
+
+it('skips host validation for terminal auth ips route', function () {
+    // These routes should be accessible with any Host header (for internal container communication)
+    $response = $this->postJson('/terminal/auth/ips', [], [
+        'Host' => 'soketi:6002',  // Another internal Docker host
+    ]);
+
+    // Should not get 400 Bad Host (might get 401 Unauthorized instead)
+    expect($response->status())->not->toBe(400);
+});
+
+it('still enforces host validation for non-terminal routes', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'https://coolify.example.com']
+    );
+
+    // Regular routes should still validate Host header
+    $response = $this->get('/', [
+        'Host' => 'evil.com',
+    ]);
+
+    // Should get 400 Bad Host for untrusted host
+    expect($response->status())->toBe(400);
+});
+
+it('skips host validation for API routes', function () {
+    // All API routes use token-based auth (Sanctum), not host validation
+    // They should be accessible from any host (mobile apps, CLI tools, scripts)
+
+    // Test health check endpoint
+    $response = $this->get('/api/health', [
+        'Host' => 'internal-lb.local',
+    ]);
+    expect($response->status())->not->toBe(400);
+
+    // Test v1 health check
+    $response = $this->get('/api/v1/health', [
+        'Host' => '10.0.0.5',
+    ]);
+    expect($response->status())->not->toBe(400);
+
+    // Test feedback endpoint
+    $response = $this->post('/api/feedback', [], [
+        'Host' => 'mobile-app.local',
+    ]);
+    expect($response->status())->not->toBe(400);
+});
+
+it('trusts localhost when FQDN is configured', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'https://coolify.example.com']
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    expect($hosts)->toContain('localhost');
+});
+
+it('trusts 127.0.0.1 when FQDN is configured', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'https://coolify.example.com']
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    expect($hosts)->toContain('127.0.0.1');
+});
+
+it('trusts IPv6 loopback when FQDN is configured', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'https://coolify.example.com']
+    );
+
+    $middleware = new TrustHosts($this->app);
+    $hosts = $middleware->hosts();
+
+    expect($hosts)->toContain('[::1]');
+});
+
+it('allows local access via localhost when FQDN is configured and request uses localhost host header', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'https://coolify.example.com']
+    );
+
+    $response = $this->get('/', [
+        'Host' => 'localhost',
+    ]);
+
+    // Should NOT be rejected as untrusted host (would be 400)
+    expect($response->status())->not->toBe(400);
+});
+
+it('skips host validation for webhook endpoints', function () {
+    // All webhook routes are under /webhooks/* prefix (see RouteServiceProvider)
+    // and use cryptographic signature validation instead of host validation
+
+    // Test GitHub webhook
+    $response = $this->post('/webhooks/source/github/events', [], [
+        'Host' => 'github-webhook-proxy.local',
+    ]);
+    expect($response->status())->not->toBe(400);
+
+    // Test GitLab webhook
+    $response = $this->post('/webhooks/source/gitlab/events/manual', [], [
+        'Host' => 'gitlab.example.com',
+    ]);
+    expect($response->status())->not->toBe(400);
+
+    // Test Stripe webhook
+    $response = $this->post('/webhooks/payments/stripe/events', [], [
+        'Host' => 'stripe-webhook-forwarder.local',
+    ]);
+    expect($response->status())->not->toBe(400);
+});
diff --git a/tests/Feature/SentinelPushDeduplicationTest.php b/tests/Feature/SentinelPushDeduplicationTest.php
index a7ecd5d4c..fb7b2df2e 100644
--- a/tests/Feature/SentinelPushDeduplicationTest.php
+++ b/tests/Feature/SentinelPushDeduplicationTest.php
@@ -8,6 +8,7 @@ use Illuminate\Contracts\Cache\LockTimeoutException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Queue;
 
 uses(RefreshDatabase::class);
@@ -81,6 +82,23 @@ it('skips the job when the second push is identical', function () use ($running)
     Queue::assertPushed(PushServerUpdateJob::class, 1);
 });
 
+it('only audits sentinel pushes that dispatch a state update', function () use ($running) {
+    $auditChannel = Mockery::mock();
+    $auditChannel->shouldReceive('info')
+        ->once()
+        ->with('sentinel.metrics_pushed', Mockery::on(function (array $context) {
+            return $context['server_uuid'] === $this->server->uuid
+                && $context['team_id'] === $this->team->id;
+        }));
+
+    Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
+
+    pushSentinel($this->token, sentinelPayload($running()))->assertOk();
+    pushSentinel($this->token, sentinelPayload($running()))->assertOk();
+
+    Queue::assertPushed(PushServerUpdateJob::class, 1);
+});
+
 it('updates the heartbeat even when the job is skipped', function () use ($running) {
     pushSentinel($this->token, sentinelPayload($running()))->assertOk();
 
diff --git a/tests/Feature/HetznerServerCreationTest.php b/tests/Feature/Server/HetznerServerCreationTest.php
similarity index 100%
rename from tests/Feature/HetznerServerCreationTest.php
rename to tests/Feature/Server/HetznerServerCreationTest.php
diff --git a/tests/Feature/SentinelUpdateCheckIndependenceTest.php b/tests/Feature/Server/SentinelUpdateCheckIndependenceTest.php
similarity index 100%
rename from tests/Feature/SentinelUpdateCheckIndependenceTest.php
rename to tests/Feature/Server/SentinelUpdateCheckIndependenceTest.php
diff --git a/tests/Feature/ServerIpUniquenessTest.php b/tests/Feature/Server/ServerIpUniquenessTest.php
similarity index 100%
rename from tests/Feature/ServerIpUniquenessTest.php
rename to tests/Feature/Server/ServerIpUniquenessTest.php
diff --git a/tests/Feature/ServerPatchCheckNotificationTest.php b/tests/Feature/Server/ServerPatchCheckNotificationTest.php
similarity index 100%
rename from tests/Feature/ServerPatchCheckNotificationTest.php
rename to tests/Feature/Server/ServerPatchCheckNotificationTest.php
diff --git a/tests/Feature/ServerSettingSentinelRestartTest.php b/tests/Feature/Server/ServerSettingSentinelRestartTest.php
similarity index 100%
rename from tests/Feature/ServerSettingSentinelRestartTest.php
rename to tests/Feature/Server/ServerSettingSentinelRestartTest.php
diff --git a/tests/Feature/ServerSettingWasChangedTest.php b/tests/Feature/Server/ServerSettingWasChangedTest.php
similarity index 100%
rename from tests/Feature/ServerSettingWasChangedTest.php
rename to tests/Feature/Server/ServerSettingWasChangedTest.php
diff --git a/tests/Feature/ServerStorageCheckIndependenceTest.php b/tests/Feature/Server/ServerStorageCheckIndependenceTest.php
similarity index 100%
rename from tests/Feature/ServerStorageCheckIndependenceTest.php
rename to tests/Feature/Server/ServerStorageCheckIndependenceTest.php
diff --git a/tests/Feature/ServiceDatabaseTeamTest.php b/tests/Feature/Service/ServiceDatabaseTeamTest.php
similarity index 100%
rename from tests/Feature/ServiceDatabaseTeamTest.php
rename to tests/Feature/Service/ServiceDatabaseTeamTest.php
diff --git a/tests/Feature/ServiceFqdnUpdatePathTest.php b/tests/Feature/Service/ServiceFqdnUpdatePathTest.php
similarity index 100%
rename from tests/Feature/ServiceFqdnUpdatePathTest.php
rename to tests/Feature/Service/ServiceFqdnUpdatePathTest.php
diff --git a/tests/Feature/StartDatabaseProxyTest.php b/tests/Feature/Service/StartDatabaseProxyTest.php
similarity index 100%
rename from tests/Feature/StartDatabaseProxyTest.php
rename to tests/Feature/Service/StartDatabaseProxyTest.php
diff --git a/tests/Feature/SidebarNavigationPreferencesTest.php b/tests/Feature/SidebarNavigationPreferencesTest.php
index f27eccd99..c341d9529 100644
--- a/tests/Feature/SidebarNavigationPreferencesTest.php
+++ b/tests/Feature/SidebarNavigationPreferencesTest.php
@@ -2,18 +2,16 @@
 
 use App\Livewire\SettingsDropdown;
 
-it('keeps changelog and the theme switcher in the sidebar without the old preferences trigger', function () {
+it('keeps changelog in the sidebar without a dedicated theme switcher', function () {
     $navbarView = file_get_contents(resource_path('views/components/navbar.blade.php'));
 
     expect($navbarView)
         ->toContain('<livewire:settings-dropdown trigger="changelog-sidebar" />')
         ->not->toContain('<livewire:settings-dropdown />')
-        ->toContain('aria-label="Theme switcher"')
-        ->toContain('aria-label="Use light theme"')
-        ->toContain('aria-label="Use system theme"')
-        ->toContain('aria-label="Use dark theme"')
-        ->toContain('cycleTheme()')
-        ->toContain("const themes = ['light', 'system', 'dark'];")
+        ->not->toContain('<span class="text-left menu-item-label">Theme</span>')
+        ->not->toContain('Click to change theme.')
+        ->not->toContain('cycleTheme()')
+        ->toContain('this.queryTheme();')
         ->toContain('pl-2 pr-3 items-start gap-3')
         ->toContain('class="flex min-w-0 flex-1 flex-col"')
         ->toContain('class="min-w-0 flex-1"')
diff --git a/tests/Feature/ScheduledJobMonitoringTest.php b/tests/Feature/Team/ScheduledJobMonitoringTest.php
similarity index 100%
rename from tests/Feature/ScheduledJobMonitoringTest.php
rename to tests/Feature/Team/ScheduledJobMonitoringTest.php
diff --git a/tests/Feature/Team/TeamDeletionTest.php b/tests/Feature/Team/TeamDeletionTest.php
new file mode 100644
index 000000000..65d6c54f1
--- /dev/null
+++ b/tests/Feature/Team/TeamDeletionTest.php
@@ -0,0 +1,54 @@
+<?php
+
+use App\Livewire\Team\Index;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->owner = User::factory()->create();
+
+    // The owner's personal team (created by factory)
+    $this->personalTeam = $this->owner->teams()->first();
+    $this->owner->teams()->updateExistingPivot($this->personalTeam->id, ['role' => 'owner']);
+
+    // A second team to delete
+    $this->teamToDelete = Team::create(['name' => 'Deletable Team', 'personal_team' => false]);
+    $this->teamToDelete->members()->attach($this->owner->id, ['role' => 'owner']);
+});
+
+test('deleting a team switches session to another team without error', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->teamToDelete]);
+
+    Livewire::test(Index::class)
+        ->call('delete')
+        ->assertRedirect(route('team.index'));
+
+    // Team should be deleted from the database
+    expect(Team::find($this->teamToDelete->id))->toBeNull();
+
+    // Session should now have the personal team
+    $sessionTeam = session('currentTeam');
+    expect($sessionTeam)->not->toBeNull()
+        ->and($sessionTeam->id)->toBe($this->personalTeam->id);
+});
+
+test('refreshSession clears session when no team exists', function () {
+    $user = User::factory()->create();
+    // Detach all teams so user has none
+    $user->teams()->detach();
+    $this->actingAs($user);
+    session(['currentTeam' => null]);
+
+    // Should not throw when no team can be resolved
+    refreshSession(null);
+
+    expect(session('currentTeam'))->toBeNull();
+});
diff --git a/tests/Feature/TeamInvitationEmailNormalizationTest.php b/tests/Feature/Team/TeamInvitationEmailNormalizationTest.php
similarity index 100%
rename from tests/Feature/TeamInvitationEmailNormalizationTest.php
rename to tests/Feature/Team/TeamInvitationEmailNormalizationTest.php
diff --git a/tests/Feature/TeamInvitationPrivilegeEscalationTest.php b/tests/Feature/Team/TeamInvitationPrivilegeEscalationTest.php
similarity index 100%
rename from tests/Feature/TeamInvitationPrivilegeEscalationTest.php
rename to tests/Feature/Team/TeamInvitationPrivilegeEscalationTest.php
diff --git a/tests/Feature/TeamNotificationCheckTest.php b/tests/Feature/Team/TeamNotificationCheckTest.php
similarity index 100%
rename from tests/Feature/TeamNotificationCheckTest.php
rename to tests/Feature/Team/TeamNotificationCheckTest.php
diff --git a/tests/Feature/TeamPolicyTest.php b/tests/Feature/TeamPolicyTest.php
deleted file mode 100644
index d6a65e231..000000000
--- a/tests/Feature/TeamPolicyTest.php
+++ /dev/null
@@ -1,184 +0,0 @@
-<?php
-
-use App\Models\Team;
-use App\Models\User;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-
-uses(RefreshDatabase::class);
-
-beforeEach(function () {
-    // Create a team with owner, admin, and member
-    $this->team = Team::factory()->create();
-
-    $this->owner = User::factory()->create();
-    $this->admin = User::factory()->create();
-    $this->member = User::factory()->create();
-
-    $this->team->members()->attach($this->owner->id, ['role' => 'owner']);
-    $this->team->members()->attach($this->admin->id, ['role' => 'admin']);
-    $this->team->members()->attach($this->member->id, ['role' => 'member']);
-});
-
-describe('update permission', function () {
-    test('owner can update team', function () {
-        $this->actingAs($this->owner);
-        session(['currentTeam' => $this->team]);
-        expect($this->owner->can('update', $this->team))->toBeTrue();
-    });
-
-    test('admin can update team', function () {
-        $this->actingAs($this->admin);
-        session(['currentTeam' => $this->team]);
-        expect($this->admin->can('update', $this->team))->toBeTrue();
-    });
-
-    test('member cannot update team', function () {
-        $this->actingAs($this->member);
-        session(['currentTeam' => $this->team]);
-        expect($this->member->can('update', $this->team))->toBeFalse();
-    });
-
-    test('non-team member cannot update team', function () {
-        $outsider = User::factory()->create();
-        $this->actingAs($outsider);
-        session(['currentTeam' => $this->team]);
-        expect($outsider->can('update', $this->team))->toBeFalse();
-    });
-});
-
-describe('delete permission', function () {
-    test('owner can delete team', function () {
-        $this->actingAs($this->owner);
-        session(['currentTeam' => $this->team]);
-        expect($this->owner->can('delete', $this->team))->toBeTrue();
-    });
-
-    test('admin can delete team', function () {
-        $this->actingAs($this->admin);
-        session(['currentTeam' => $this->team]);
-        expect($this->admin->can('delete', $this->team))->toBeTrue();
-    });
-
-    test('member cannot delete team', function () {
-        $this->actingAs($this->member);
-        session(['currentTeam' => $this->team]);
-        expect($this->member->can('delete', $this->team))->toBeFalse();
-    });
-
-    test('non-team member cannot delete team', function () {
-        $outsider = User::factory()->create();
-        $this->actingAs($outsider);
-        session(['currentTeam' => $this->team]);
-        expect($outsider->can('delete', $this->team))->toBeFalse();
-    });
-});
-
-describe('manageMembers permission', function () {
-    test('owner can manage members', function () {
-        $this->actingAs($this->owner);
-        session(['currentTeam' => $this->team]);
-        expect($this->owner->can('manageMembers', $this->team))->toBeTrue();
-    });
-
-    test('admin can manage members', function () {
-        $this->actingAs($this->admin);
-        session(['currentTeam' => $this->team]);
-        expect($this->admin->can('manageMembers', $this->team))->toBeTrue();
-    });
-
-    test('member cannot manage members', function () {
-        $this->actingAs($this->member);
-        session(['currentTeam' => $this->team]);
-        expect($this->member->can('manageMembers', $this->team))->toBeFalse();
-    });
-
-    test('non-team member cannot manage members', function () {
-        $outsider = User::factory()->create();
-        $this->actingAs($outsider);
-        session(['currentTeam' => $this->team]);
-        expect($outsider->can('manageMembers', $this->team))->toBeFalse();
-    });
-});
-
-describe('viewAdmin permission', function () {
-    test('owner can view admin panel', function () {
-        $this->actingAs($this->owner);
-        session(['currentTeam' => $this->team]);
-        expect($this->owner->can('viewAdmin', $this->team))->toBeTrue();
-    });
-
-    test('admin can view admin panel', function () {
-        $this->actingAs($this->admin);
-        session(['currentTeam' => $this->team]);
-        expect($this->admin->can('viewAdmin', $this->team))->toBeTrue();
-    });
-
-    test('member cannot view admin panel', function () {
-        $this->actingAs($this->member);
-        session(['currentTeam' => $this->team]);
-        expect($this->member->can('viewAdmin', $this->team))->toBeFalse();
-    });
-
-    test('non-team member cannot view admin panel', function () {
-        $outsider = User::factory()->create();
-        $this->actingAs($outsider);
-        session(['currentTeam' => $this->team]);
-        expect($outsider->can('viewAdmin', $this->team))->toBeFalse();
-    });
-});
-
-describe('manageInvitations permission (privilege escalation fix)', function () {
-    test('owner can manage invitations', function () {
-        $this->actingAs($this->owner);
-        session(['currentTeam' => $this->team]);
-        expect($this->owner->can('manageInvitations', $this->team))->toBeTrue();
-    });
-
-    test('admin can manage invitations', function () {
-        $this->actingAs($this->admin);
-        session(['currentTeam' => $this->team]);
-        expect($this->admin->can('manageInvitations', $this->team))->toBeTrue();
-    });
-
-    test('member cannot manage invitations (SECURITY FIX)', function () {
-        // This test verifies the privilege escalation vulnerability is fixed
-        // Previously, members could see and manage admin invitations
-        $this->actingAs($this->member);
-        session(['currentTeam' => $this->team]);
-        expect($this->member->can('manageInvitations', $this->team))->toBeFalse();
-    });
-
-    test('non-team member cannot manage invitations', function () {
-        $outsider = User::factory()->create();
-        $this->actingAs($outsider);
-        session(['currentTeam' => $this->team]);
-        expect($outsider->can('manageInvitations', $this->team))->toBeFalse();
-    });
-});
-
-describe('view permission', function () {
-    test('owner can view team', function () {
-        $this->actingAs($this->owner);
-        session(['currentTeam' => $this->team]);
-        expect($this->owner->can('view', $this->team))->toBeTrue();
-    });
-
-    test('admin can view team', function () {
-        $this->actingAs($this->admin);
-        session(['currentTeam' => $this->team]);
-        expect($this->admin->can('view', $this->team))->toBeTrue();
-    });
-
-    test('member can view team', function () {
-        $this->actingAs($this->member);
-        session(['currentTeam' => $this->team]);
-        expect($this->member->can('view', $this->team))->toBeTrue();
-    });
-
-    test('non-team member cannot view team', function () {
-        $outsider = User::factory()->create();
-        $this->actingAs($outsider);
-        session(['currentTeam' => $this->team]);
-        expect($outsider->can('view', $this->team))->toBeFalse();
-    });
-});
diff --git a/tests/Feature/UpgradeComponentTest.php b/tests/Feature/UpgradeComponentTest.php
index aae32a7f7..0d869d3be 100644
--- a/tests/Feature/UpgradeComponentTest.php
+++ b/tests/Feature/UpgradeComponentTest.php
@@ -10,7 +10,7 @@ uses(RefreshDatabase::class);
 
 it('initializes latest version during mount from cached versions data', function () {
     config(['constants.coolify.version' => '4.0.0-beta.998']);
-    InstanceSettings::create([
+    InstanceSettings::forceCreate([
         'id' => 0,
         'new_version_available' => true,
     ]);
@@ -34,8 +34,22 @@ it('initializes latest version during mount from cached versions data', function
         ->assertSee('4.0.0-beta.999');
 });
 
+it('uses sidebar state css instead of nested alpine state for upgrade labels', function () {
+    $upgradeView = file_get_contents(resource_path('views/livewire/upgrade.blade.php'));
+    $utilitiesCss = file_get_contents(resource_path('css/utilities.css'));
+
+    expect($upgradeView)
+        ->toContain('class="text-left menu-item-label sidebar-collapsed-label"')
+        ->toContain('>In progress</span>')
+        ->toContain('>Upgrade</span>')
+        ->not->toContain(':class="collapsed && \'lg:hidden\'"')
+        ->and($utilitiesCss)
+        ->toContain('.sidebar-collapsed .sidebar-collapsed-label')
+        ->toContain('display: none;');
+});
+
 it('falls back to 0.0.0 during mount when cached versions data is unavailable', function () {
-    InstanceSettings::create([
+    InstanceSettings::forceCreate([
         'id' => 0,
         'new_version_available' => false,
     ]);
@@ -51,7 +65,7 @@ it('falls back to 0.0.0 during mount when cached versions data is unavailable',
 
 it('clears stale upgrade availability when current version already matches latest version', function () {
     config(['constants.coolify.version' => '4.0.0-beta.999']);
-    InstanceSettings::create([
+    InstanceSettings::forceCreate([
         'id' => 0,
         'new_version_available' => true,
     ]);
@@ -71,12 +85,12 @@ it('clears stale upgrade availability when current version already matches lates
         ->assertSet('latestVersion', '4.0.0-beta.999')
         ->assertSet('isUpgradeAvailable', false);
 
-    expect(InstanceSettings::findOrFail(0)->new_version_available)->toBeFalse();
+    expect((bool) InstanceSettings::findOrFail(0)->new_version_available)->toBeFalse();
 });
 
 it('clears stale upgrade availability when current version is newer than cached latest version', function () {
     config(['constants.coolify.version' => '4.0.0-beta.1000']);
-    InstanceSettings::create([
+    InstanceSettings::forceCreate([
         'id' => 0,
         'new_version_available' => true,
     ]);
@@ -96,5 +110,5 @@ it('clears stale upgrade availability when current version is newer than cached
         ->assertSet('latestVersion', '4.0.0-beta.999')
         ->assertSet('isUpgradeAvailable', false);
 
-    expect(InstanceSettings::findOrFail(0)->new_version_available)->toBeFalse();
+    expect((bool) InstanceSettings::findOrFail(0)->new_version_available)->toBeFalse();
 });
diff --git a/tests/Pest.php b/tests/Pest.php
index cec77b86f..81df3649b 100644
--- a/tests/Pest.php
+++ b/tests/Pest.php
@@ -2,6 +2,7 @@
 
 use App\Models\Server;
 use Illuminate\Support\Once;
+use Tests\TestCase;
 
 /*
 |--------------------------------------------------------------------------
@@ -13,7 +14,7 @@ use Illuminate\Support\Once;
 | need to change it using the "uses()" function to bind a different classes or traits.
 |
 */
-uses(Tests\TestCase::class)->in('Feature', 'v4/Feature', 'v4/Browser');
+uses(TestCase::class)->in('Feature', 'v4/Feature', 'v4/Browser');
 
 /*
 |--------------------------------------------------------------------------
@@ -31,6 +32,15 @@ beforeEach(function () {
     Server::flushIdentityMap();
 });
 
+function loginAndSkipBoarding(string $email = 'test@example.com', string $password = 'password'): mixed
+{
+    return visit('/login')
+        ->fill('email', $email)
+        ->fill('password', $password)
+        ->click('Login')
+        ->click('Skip Setup');
+}
+
 /*
 |--------------------------------------------------------------------------
 | Expectations
diff --git a/tests/Unit/Policies/ApiTokenPolicyTest.php b/tests/Unit/Policies/ApiTokenPolicyTest.php
new file mode 100644
index 000000000..98c60aae8
--- /dev/null
+++ b/tests/Unit/Policies/ApiTokenPolicyTest.php
@@ -0,0 +1,193 @@
+<?php
+
+use App\Models\User;
+use App\Policies\ApiTokenPolicy;
+use Laravel\Sanctum\PersonalAccessToken;
+
+it('allows any user to view any api tokens', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows any user to create api tokens', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('allows any user to manage api tokens', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->manage($user))->toBeTrue();
+});
+
+it('allows owner to view their own api token', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->id = 1;
+
+    $token = Mockery::mock(PersonalAccessToken::class)->makePartial();
+    $token->tokenable_id = 1;
+    $token->tokenable_type = User::class;
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->view($user, $token))->toBeTrue();
+});
+
+it('denies non-owner from viewing api token', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->id = 2;
+
+    $token = Mockery::mock(PersonalAccessToken::class)->makePartial();
+    $token->tokenable_id = 1;
+    $token->tokenable_type = User::class;
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->view($user, $token))->toBeFalse();
+});
+
+it('allows owner to update their own api token', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->id = 1;
+
+    $token = Mockery::mock(PersonalAccessToken::class)->makePartial();
+    $token->tokenable_id = 1;
+    $token->tokenable_type = User::class;
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->update($user, $token))->toBeTrue();
+});
+
+it('denies non-owner from updating api token', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->id = 2;
+
+    $token = Mockery::mock(PersonalAccessToken::class)->makePartial();
+    $token->tokenable_id = 1;
+    $token->tokenable_type = User::class;
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->update($user, $token))->toBeFalse();
+});
+
+it('allows owner to delete their own api token', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->id = 1;
+
+    $token = Mockery::mock(PersonalAccessToken::class)->makePartial();
+    $token->tokenable_id = 1;
+    $token->tokenable_type = User::class;
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->delete($user, $token))->toBeTrue();
+});
+
+it('denies non-owner from deleting api token', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->id = 2;
+
+    $token = Mockery::mock(PersonalAccessToken::class)->makePartial();
+    $token->tokenable_id = 1;
+    $token->tokenable_type = User::class;
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->delete($user, $token))->toBeFalse();
+});
+
+it('allows admin to use root permissions', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->useRootPermissions($user))->toBeTrue();
+});
+
+it('allows owner to use root permissions', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+    $user->shouldReceive('isOwner')->andReturn(true);
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->useRootPermissions($user))->toBeTrue();
+});
+
+it('denies member from using root permissions', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+    $user->shouldReceive('isOwner')->andReturn(false);
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->useRootPermissions($user))->toBeFalse();
+});
+
+it('allows admin to use write permissions', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->useWritePermissions($user))->toBeTrue();
+});
+
+it('denies member from using write permissions', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+    $user->shouldReceive('isOwner')->andReturn(false);
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->useWritePermissions($user))->toBeFalse();
+});
+
+it('allows admin to use deploy permissions', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->useDeployPermissions($user))->toBeTrue();
+});
+
+it('allows owner to use deploy permissions', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+    $user->shouldReceive('isOwner')->andReturn(true);
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->useDeployPermissions($user))->toBeTrue();
+});
+
+it('denies member from using deploy permissions', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+    $user->shouldReceive('isOwner')->andReturn(false);
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->useDeployPermissions($user))->toBeFalse();
+});
+
+it('allows admin to use sensitive permissions', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->useSensitivePermissions($user))->toBeTrue();
+});
+
+it('allows owner to use sensitive permissions', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+    $user->shouldReceive('isOwner')->andReturn(true);
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->useSensitivePermissions($user))->toBeTrue();
+});
+
+it('denies member from using sensitive permissions', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+    $user->shouldReceive('isOwner')->andReturn(false);
+
+    $policy = new ApiTokenPolicy;
+    expect($policy->useSensitivePermissions($user))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/ApplicationPolicyTest.php b/tests/Unit/Policies/ApplicationPolicyTest.php
new file mode 100644
index 000000000..e3c80a4e5
--- /dev/null
+++ b/tests/Unit/Policies/ApplicationPolicyTest.php
@@ -0,0 +1,237 @@
+<?php
+
+use App\Models\Application;
+use App\Models\User;
+use App\Policies\ApplicationPolicy;
+
+it('allows any user to view any applications', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new ApplicationPolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows team member to view their own team application', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->view($user, $application))->toBeTrue();
+});
+
+it('denies non-member to view another team application', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 2]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->view($user, $application))->toBeFalse();
+});
+
+it('denies view when application has no team', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn(null);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->view($user, $application))->toBeFalse();
+});
+
+it('allows admin to create an application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies member to create an application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows team admin to update their own team application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->update($user, $application)->allowed())->toBeTrue();
+});
+
+it('denies team member to update their own team application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->update($user, $application)->allowed())->toBeFalse();
+});
+
+it('denies update when application has no team', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn(null);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->update($user, $application)->allowed())->toBeFalse();
+});
+
+it('allows team admin to delete their own team application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->delete($user, $application))->toBeTrue();
+});
+
+it('denies team member to delete their own team application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->delete($user, $application))->toBeFalse();
+});
+
+it('denies delete when application has no team', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn(null);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->delete($user, $application))->toBeFalse();
+});
+
+it('allows team admin to deploy their own team application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->deploy($user, $application))->toBeTrue();
+});
+
+it('denies team member to deploy their own team application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->deploy($user, $application))->toBeFalse();
+});
+
+it('allows team admin to manage deployments', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->manageDeployments($user, $application))->toBeTrue();
+});
+
+it('denies team member to manage deployments', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->manageDeployments($user, $application))->toBeFalse();
+});
+
+it('allows team admin to manage environment variables', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->manageEnvironment($user, $application))->toBeTrue();
+});
+
+it('denies team member to manage environment variables', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->manageEnvironment($user, $application))->toBeFalse();
+});
+
+it('allows admin to cleanup deployment queue', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->cleanupDeploymentQueue($user))->toBeTrue();
+});
+
+it('denies member to cleanup deployment queue', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ApplicationPolicy;
+    expect($policy->cleanupDeploymentQueue($user))->toBeFalse();
+});
+
+it('denies restore for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $application = Mockery::mock(Application::class)->makePartial();
+
+    $policy = new ApplicationPolicy;
+    expect($policy->restore($user, $application))->toBeFalse();
+});
+
+it('denies force delete for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $application = Mockery::mock(Application::class)->makePartial();
+
+    $policy = new ApplicationPolicy;
+    expect($policy->forceDelete($user, $application))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/ApplicationPreviewPolicyTest.php b/tests/Unit/Policies/ApplicationPreviewPolicyTest.php
new file mode 100644
index 000000000..38e4eef29
--- /dev/null
+++ b/tests/Unit/Policies/ApplicationPreviewPolicyTest.php
@@ -0,0 +1,239 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\User;
+use App\Policies\ApplicationPreviewPolicy;
+
+it('allows any user to view any application previews', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows team member to view application preview', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->view($user, $preview))->toBeTrue();
+});
+
+it('denies non-team member from viewing application preview', function () {
+    $teams = collect([
+        (object) ['id' => 2, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->view($user, $preview))->toBeFalse();
+});
+
+it('denies viewing application preview with null application', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn(null);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->view($user, $preview))->toBeFalse();
+});
+
+it('allows admin user to create application preview', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies non-admin user from creating application preview', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows team admin to update application preview', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->update($user, $preview)->allowed())->toBeTrue();
+});
+
+it('denies team member from updating application preview', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->update($user, $preview)->allowed())->toBeFalse();
+});
+
+it('denies updating application preview with null application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn(null);
+
+    $policy = new ApplicationPreviewPolicy;
+    $response = $policy->update($user, $preview);
+    expect($response->allowed())->toBeFalse();
+});
+
+it('allows team admin to delete application preview', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->delete($user, $preview))->toBeTrue();
+});
+
+it('denies team member from deleting application preview', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->delete($user, $preview))->toBeFalse();
+});
+
+it('denies deleting application preview with null application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn(null);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->delete($user, $preview))->toBeFalse();
+});
+
+it('allows team admin to deploy application preview', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->deploy($user, $preview))->toBeTrue();
+});
+
+it('denies team member from deploying application preview', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->deploy($user, $preview))->toBeFalse();
+});
+
+it('allows team admin to manage preview deployments', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->manageDeployments($user, $preview))->toBeTrue();
+});
+
+it('denies team member from managing preview deployments', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+    $preview->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->manageDeployments($user, $preview))->toBeFalse();
+});
+
+it('denies restoring application preview', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->restore($user, $preview))->toBeFalse();
+});
+
+it('denies force deleting application preview', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $preview = Mockery::mock(ApplicationPreview::class)->makePartial();
+
+    $policy = new ApplicationPreviewPolicy;
+    expect($policy->forceDelete($user, $preview))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/ApplicationSettingPolicyTest.php b/tests/Unit/Policies/ApplicationSettingPolicyTest.php
new file mode 100644
index 000000000..c595a3e96
--- /dev/null
+++ b/tests/Unit/Policies/ApplicationSettingPolicyTest.php
@@ -0,0 +1,178 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use App\Models\User;
+use App\Policies\ApplicationSettingPolicy;
+
+it('allows any user to view any application settings', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows team member to view application setting', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $setting = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $setting->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->view($user, $setting))->toBeTrue();
+});
+
+it('denies non-team member from viewing application setting', function () {
+    $teams = collect([
+        (object) ['id' => 2, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $setting = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $setting->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->view($user, $setting))->toBeFalse();
+});
+
+it('denies viewing application setting with null application', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $setting = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $setting->shouldReceive('getAttribute')->with('application')->andReturn(null);
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->view($user, $setting))->toBeFalse();
+});
+
+it('allows admin user to create application setting', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies non-admin user from creating application setting', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows team admin to update application setting', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $setting = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $setting->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->update($user, $setting))->toBeTrue();
+});
+
+it('denies team member from updating application setting', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $setting = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $setting->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->update($user, $setting))->toBeFalse();
+});
+
+it('denies updating application setting with null application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $setting = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $setting->shouldReceive('getAttribute')->with('application')->andReturn(null);
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->update($user, $setting))->toBeFalse();
+});
+
+it('allows team admin to delete application setting', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $setting = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $setting->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->delete($user, $setting))->toBeTrue();
+});
+
+it('denies team member from deleting application setting', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $team = (object) ['id' => 1];
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('team')->andReturn($team);
+
+    $setting = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $setting->shouldReceive('getAttribute')->with('application')->andReturn($application);
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->delete($user, $setting))->toBeFalse();
+});
+
+it('denies deleting application setting with null application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $setting = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $setting->shouldReceive('getAttribute')->with('application')->andReturn(null);
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->delete($user, $setting))->toBeFalse();
+});
+
+it('denies restoring application setting', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $setting = Mockery::mock(ApplicationSetting::class)->makePartial();
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->restore($user, $setting))->toBeFalse();
+});
+
+it('denies force deleting application setting', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $setting = Mockery::mock(ApplicationSetting::class)->makePartial();
+
+    $policy = new ApplicationSettingPolicy;
+    expect($policy->forceDelete($user, $setting))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/DatabasePolicyTest.php b/tests/Unit/Policies/DatabasePolicyTest.php
new file mode 100644
index 000000000..9924a43cb
--- /dev/null
+++ b/tests/Unit/Policies/DatabasePolicyTest.php
@@ -0,0 +1,221 @@
+<?php
+
+use App\Models\StandalonePostgresql;
+use App\Models\User;
+use App\Policies\DatabasePolicy;
+
+it('allows any user to view any databases', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new DatabasePolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows team member to view their own team database', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->view($user, $database))->toBeTrue();
+});
+
+it('denies non-member to view another team database', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 2]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->view($user, $database))->toBeFalse();
+});
+
+it('denies view when database has no team', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn(null);
+
+    $policy = new DatabasePolicy;
+    expect($policy->view($user, $database))->toBeFalse();
+});
+
+it('allows admin to create a database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new DatabasePolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies member to create a database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new DatabasePolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows team admin to update their own team database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->update($user, $database)->allowed())->toBeTrue();
+});
+
+it('denies team member to update their own team database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->update($user, $database)->allowed())->toBeFalse();
+});
+
+it('denies update when database has no team', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn(null);
+
+    $policy = new DatabasePolicy;
+    expect($policy->update($user, $database)->allowed())->toBeFalse();
+});
+
+it('allows team admin to delete their own team database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->delete($user, $database))->toBeTrue();
+});
+
+it('denies team member to delete their own team database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->delete($user, $database))->toBeFalse();
+});
+
+it('denies delete when database has no team', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn(null);
+
+    $policy = new DatabasePolicy;
+    expect($policy->delete($user, $database))->toBeFalse();
+});
+
+it('allows team admin to manage their own team database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->manage($user, $database))->toBeTrue();
+});
+
+it('denies team member to manage their own team database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->manage($user, $database))->toBeFalse();
+});
+
+it('allows team admin to manage backups', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->manageBackups($user, $database))->toBeTrue();
+});
+
+it('denies team member to manage backups', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->manageBackups($user, $database))->toBeFalse();
+});
+
+it('allows team admin to manage database environment variables', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->manageEnvironment($user, $database))->toBeTrue();
+});
+
+it('denies team member to manage database environment variables', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+    $database->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new DatabasePolicy;
+    expect($policy->manageEnvironment($user, $database))->toBeFalse();
+});
+
+it('denies restore for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+
+    $policy = new DatabasePolicy;
+    expect($policy->restore($user, $database))->toBeFalse();
+});
+
+it('denies force delete for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $database = Mockery::mock(StandalonePostgresql::class)->makePartial();
+
+    $policy = new DatabasePolicy;
+    expect($policy->forceDelete($user, $database))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/EnvironmentPolicyTest.php b/tests/Unit/Policies/EnvironmentPolicyTest.php
new file mode 100644
index 000000000..3fe8f1703
--- /dev/null
+++ b/tests/Unit/Policies/EnvironmentPolicyTest.php
@@ -0,0 +1,155 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\User;
+use App\Policies\EnvironmentPolicy;
+
+it('allows any user to view any environments', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows team member to view their own team environment', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $environment = Mockery::mock(Environment::class)->makePartial();
+    $environment->shouldReceive('getAttribute')->with('project')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->view($user, $environment))->toBeTrue();
+});
+
+it('denies non-member to view another team environment', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $environment = Mockery::mock(Environment::class)->makePartial();
+    $environment->shouldReceive('getAttribute')->with('project')->andReturn((object) ['team_id' => 2]);
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->view($user, $environment))->toBeFalse();
+});
+
+it('denies view when environment has no project', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $environment = Mockery::mock(Environment::class)->makePartial();
+    $environment->shouldReceive('getAttribute')->with('project')->andReturn(null);
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->view($user, $environment))->toBeFalse();
+});
+
+it('allows admin to create an environment', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies member to create an environment', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows team admin to update their own team environment', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $environment = Mockery::mock(Environment::class)->makePartial();
+    $environment->shouldReceive('getAttribute')->with('project')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->update($user, $environment))->toBeTrue();
+});
+
+it('denies team member to update their own team environment', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $environment = Mockery::mock(Environment::class)->makePartial();
+    $environment->shouldReceive('getAttribute')->with('project')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->update($user, $environment))->toBeFalse();
+});
+
+it('denies update when environment has no project', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $environment = Mockery::mock(Environment::class)->makePartial();
+    $environment->shouldReceive('getAttribute')->with('project')->andReturn(null);
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->update($user, $environment))->toBeFalse();
+});
+
+it('allows team admin to delete their own team environment', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $environment = Mockery::mock(Environment::class)->makePartial();
+    $environment->shouldReceive('getAttribute')->with('project')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->delete($user, $environment))->toBeTrue();
+});
+
+it('denies team member to delete their own team environment', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $environment = Mockery::mock(Environment::class)->makePartial();
+    $environment->shouldReceive('getAttribute')->with('project')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->delete($user, $environment))->toBeFalse();
+});
+
+it('denies delete when environment has no project', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $environment = Mockery::mock(Environment::class)->makePartial();
+    $environment->shouldReceive('getAttribute')->with('project')->andReturn(null);
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->delete($user, $environment))->toBeFalse();
+});
+
+it('denies restore for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $environment = Mockery::mock(Environment::class)->makePartial();
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->restore($user, $environment))->toBeFalse();
+});
+
+it('denies force delete for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $environment = Mockery::mock(Environment::class)->makePartial();
+
+    $policy = new EnvironmentPolicy;
+    expect($policy->forceDelete($user, $environment))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/EnvironmentVariablePolicyTest.php b/tests/Unit/Policies/EnvironmentVariablePolicyTest.php
new file mode 100644
index 000000000..d5d3ec410
--- /dev/null
+++ b/tests/Unit/Policies/EnvironmentVariablePolicyTest.php
@@ -0,0 +1,199 @@
+<?php
+
+use App\Models\Application;
+use App\Models\EnvironmentVariable;
+use App\Models\User;
+use App\Policies\EnvironmentVariablePolicy;
+use Illuminate\Support\Collection;
+
+it('allows any user to view any environment variables', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows team member to view environment variable', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->teams = new Collection([(object) ['id' => 1]]);
+
+    $resource = Mockery::mock(Application::class)->makePartial();
+    $resource->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn($resource);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->view($user, $envVar))->toBeTrue();
+});
+
+it('denies non-team member from viewing environment variable', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->teams = new Collection([(object) ['id' => 2]]);
+
+    $resource = Mockery::mock(Application::class)->makePartial();
+    $resource->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn($resource);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->view($user, $envVar))->toBeFalse();
+});
+
+it('denies view when resourceable is null', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->teams = new Collection([(object) ['id' => 1]]);
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn(null);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->view($user, $envVar))->toBeFalse();
+});
+
+it('allows admin to create environment variable', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies member from creating environment variable', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows team admin to update environment variable', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $resource = Mockery::mock(Application::class)->makePartial();
+    $resource->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn($resource);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->update($user, $envVar))->toBeTrue();
+});
+
+it('denies non-admin from updating environment variable', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $resource = Mockery::mock(Application::class)->makePartial();
+    $resource->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn($resource);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->update($user, $envVar))->toBeFalse();
+});
+
+it('denies update when resourceable is null', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn(null);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->update($user, $envVar))->toBeFalse();
+});
+
+it('allows team admin to delete environment variable', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $resource = Mockery::mock(Application::class)->makePartial();
+    $resource->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn($resource);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->delete($user, $envVar))->toBeTrue();
+});
+
+it('denies non-admin from deleting environment variable', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $resource = Mockery::mock(Application::class)->makePartial();
+    $resource->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn($resource);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->delete($user, $envVar))->toBeFalse();
+});
+
+it('denies delete when resourceable is null', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn(null);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->delete($user, $envVar))->toBeFalse();
+});
+
+it('denies restore for environment variable', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->restore($user, $envVar))->toBeFalse();
+});
+
+it('denies force delete for environment variable', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->forceDelete($user, $envVar))->toBeFalse();
+});
+
+it('allows team admin to manage environment', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $resource = Mockery::mock(Application::class)->makePartial();
+    $resource->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn($resource);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->manageEnvironment($user, $envVar))->toBeTrue();
+});
+
+it('denies non-admin from managing environment', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $resource = Mockery::mock(Application::class)->makePartial();
+    $resource->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn($resource);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->manageEnvironment($user, $envVar))->toBeFalse();
+});
+
+it('denies manage environment when resourceable is null', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $envVar = Mockery::mock(EnvironmentVariable::class)->makePartial();
+    $envVar->shouldReceive('getAttribute')->with('resourceable')->andReturn(null);
+
+    $policy = new EnvironmentVariablePolicy;
+    expect($policy->manageEnvironment($user, $envVar))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/GithubAppPolicyTest.php b/tests/Unit/Policies/GithubAppPolicyTest.php
index 55ba7f3d3..5aedbf7b8 100644
--- a/tests/Unit/Policies/GithubAppPolicyTest.php
+++ b/tests/Unit/Policies/GithubAppPolicyTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Models\GithubApp;
 use App\Models\User;
 use App\Policies\GithubAppPolicy;
 
@@ -13,12 +14,7 @@ it('allows any user to view any github apps', function () {
 it('allows any user to view system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = true;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: true);
 
     $policy = new GithubAppPolicy;
     expect($policy->view($user, $model))->toBeTrue();
@@ -32,12 +28,7 @@ it('allows team member to view non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = false;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: false);
 
     $policy = new GithubAppPolicy;
     expect($policy->view($user, $model))->toBeTrue();
@@ -51,12 +42,7 @@ it('denies non-team member to view non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = false;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: false);
 
     $policy = new GithubAppPolicy;
     expect($policy->view($user, $model))->toBeFalse();
@@ -82,12 +68,7 @@ it('allows user with system access to update system-wide github app', function (
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('canAccessSystemResources')->andReturn(true);
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = true;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: true);
 
     $policy = new GithubAppPolicy;
     expect($policy->update($user, $model))->toBeTrue();
@@ -97,12 +78,7 @@ it('denies user without system access to update system-wide github app', functio
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('canAccessSystemResources')->andReturn(false);
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = true;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: true);
 
     $policy = new GithubAppPolicy;
     expect($policy->update($user, $model))->toBeFalse();
@@ -112,12 +88,7 @@ it('allows team admin to update non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = false;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: false);
 
     $policy = new GithubAppPolicy;
     expect($policy->update($user, $model))->toBeTrue();
@@ -127,12 +98,7 @@ it('denies team member to update non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = false;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: false);
 
     $policy = new GithubAppPolicy;
     expect($policy->update($user, $model))->toBeFalse();
@@ -142,12 +108,7 @@ it('allows user with system access to delete system-wide github app', function (
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('canAccessSystemResources')->andReturn(true);
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = true;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: true);
 
     $policy = new GithubAppPolicy;
     expect($policy->delete($user, $model))->toBeTrue();
@@ -157,12 +118,7 @@ it('denies user without system access to delete system-wide github app', functio
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('canAccessSystemResources')->andReturn(false);
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = true;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: true);
 
     $policy = new GithubAppPolicy;
     expect($policy->delete($user, $model))->toBeFalse();
@@ -172,12 +128,7 @@ it('allows team admin to delete non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = false;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: false);
 
     $policy = new GithubAppPolicy;
     expect($policy->delete($user, $model))->toBeTrue();
@@ -187,12 +138,7 @@ it('denies team member to delete non-system-wide github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = false;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: false);
 
     $policy = new GithubAppPolicy;
     expect($policy->delete($user, $model))->toBeFalse();
@@ -201,12 +147,7 @@ it('denies team member to delete non-system-wide github app', function () {
 it('denies restore of github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = false;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: false);
 
     $policy = new GithubAppPolicy;
     expect($policy->restore($user, $model))->toBeFalse();
@@ -215,13 +156,17 @@ it('denies restore of github app', function () {
 it('denies force delete of github app', function () {
     $user = Mockery::mock(User::class)->makePartial();
 
-    $model = new class
-    {
-        public $team_id = 1;
-
-        public $is_system_wide = false;
-    };
+    $model = mockGithubApp(teamId: 1, isSystemWide: false);
 
     $policy = new GithubAppPolicy;
     expect($policy->forceDelete($user, $model))->toBeFalse();
 });
+
+function mockGithubApp(int $teamId, bool $isSystemWide): GithubApp
+{
+    $githubApp = Mockery::mock(GithubApp::class)->makePartial();
+    $githubApp->team_id = $teamId;
+    $githubApp->is_system_wide = $isSystemWide;
+
+    return $githubApp;
+}
diff --git a/tests/Unit/Policies/NotificationPolicyTest.php b/tests/Unit/Policies/NotificationPolicyTest.php
new file mode 100644
index 000000000..0843a71c3
--- /dev/null
+++ b/tests/Unit/Policies/NotificationPolicyTest.php
@@ -0,0 +1,175 @@
+<?php
+
+use App\Models\User;
+use App\Policies\NotificationPolicy;
+use Illuminate\Database\Eloquent\Model;
+
+it('allows team member to view notification settings', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new NotificationPolicy;
+    expect($policy->view($user, $notification))->toBeTrue();
+});
+
+it('denies non-team member from viewing notification settings', function () {
+    $teams = collect([
+        (object) ['id' => 2, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new NotificationPolicy;
+    expect($policy->view($user, $notification))->toBeFalse();
+});
+
+it('denies viewing notification settings with no team', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn(null);
+
+    $policy = new NotificationPolicy;
+    expect($policy->view($user, $notification))->toBeFalse();
+});
+
+it('allows team admin to update notification settings', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new NotificationPolicy;
+    expect($policy->update($user, $notification))->toBeTrue();
+});
+
+it('denies team member from updating notification settings', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new NotificationPolicy;
+    expect($policy->update($user, $notification))->toBeFalse();
+});
+
+it('denies updating notification settings with no team', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn(null);
+
+    $policy = new NotificationPolicy;
+    expect($policy->update($user, $notification))->toBeFalse();
+});
+
+it('allows team admin to manage notification settings', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new NotificationPolicy;
+    expect($policy->manage($user, $notification))->toBeTrue();
+});
+
+it('denies team member from managing notification settings', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new NotificationPolicy;
+    expect($policy->manage($user, $notification))->toBeFalse();
+});
+
+it('denies managing notification settings with no team', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn(null);
+
+    $policy = new NotificationPolicy;
+    expect($policy->manage($user, $notification))->toBeFalse();
+});
+
+it('allows team admin to send test notification', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new NotificationPolicy;
+    expect($policy->sendTest($user, $notification))->toBeTrue();
+});
+
+it('denies team member from sending test notification', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new NotificationPolicy;
+    expect($policy->sendTest($user, $notification))->toBeFalse();
+});
+
+it('denies sending test notification with no team', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn(null);
+
+    $policy = new NotificationPolicy;
+    expect($policy->sendTest($user, $notification))->toBeFalse();
+});
+
+it('allows team member to view but not update notification settings', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new NotificationPolicy;
+    expect($policy->view($user, $notification))->toBeTrue();
+    expect($policy->update($user, $notification))->toBeFalse();
+});
+
+it('allows team admin to view and update notification settings', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $notification = Mockery::mock(Model::class)->makePartial();
+    $notification->shouldReceive('getAttribute')->with('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new NotificationPolicy;
+    expect($policy->view($user, $notification))->toBeTrue();
+    expect($policy->update($user, $notification))->toBeTrue();
+});
diff --git a/tests/Unit/Policies/PrivateKeyPolicyTest.php b/tests/Unit/Policies/PrivateKeyPolicyTest.php
index 6844d92f7..281fdd5f8 100644
--- a/tests/Unit/Policies/PrivateKeyPolicyTest.php
+++ b/tests/Unit/Policies/PrivateKeyPolicyTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Models\PrivateKey;
 use App\Models\User;
 use App\Policies\PrivateKeyPolicy;
 
@@ -11,10 +12,8 @@ it('allows root team admin to view system private key', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 0;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 0;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->view($user, $privateKey))->toBeTrue();
@@ -28,10 +27,8 @@ it('allows root team owner to view system private key', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 0;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 0;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->view($user, $privateKey))->toBeTrue();
@@ -45,10 +42,8 @@ it('denies regular member of root team to view system private key', function ()
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 0;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 0;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->view($user, $privateKey))->toBeFalse();
@@ -62,10 +57,8 @@ it('denies non-root team member to view system private key', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 0;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 0;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->view($user, $privateKey))->toBeFalse();
@@ -79,10 +72,8 @@ it('allows team member to view their own team private key', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 1;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 1;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->view($user, $privateKey))->toBeTrue();
@@ -96,10 +87,8 @@ it('denies team member to view another team private key', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 2;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 2;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->view($user, $privateKey))->toBeFalse();
@@ -113,10 +102,8 @@ it('allows root team admin to update system private key', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 0;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 0;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->update($user, $privateKey))->toBeTrue();
@@ -130,10 +117,8 @@ it('denies root team member to update system private key', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 0;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 0;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->update($user, $privateKey))->toBeFalse();
@@ -147,10 +132,8 @@ it('allows team admin to update their own team private key', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 1;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 1;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->update($user, $privateKey))->toBeTrue();
@@ -164,10 +147,8 @@ it('denies team member to update their own team private key', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 1;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 1;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->update($user, $privateKey))->toBeFalse();
@@ -181,10 +162,8 @@ it('allows root team admin to delete system private key', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 0;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 0;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->delete($user, $privateKey))->toBeTrue();
@@ -198,10 +177,8 @@ it('denies root team member to delete system private key', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $privateKey = new class
-    {
-        public $team_id = 0;
-    };
+    $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
+    $privateKey->team_id = 0;
 
     $policy = new PrivateKeyPolicy;
     expect($policy->delete($user, $privateKey))->toBeFalse();
diff --git a/tests/Unit/Policies/ProjectPolicyTest.php b/tests/Unit/Policies/ProjectPolicyTest.php
new file mode 100644
index 000000000..8b4a824f6
--- /dev/null
+++ b/tests/Unit/Policies/ProjectPolicyTest.php
@@ -0,0 +1,122 @@
+<?php
+
+use App\Models\Project;
+use App\Models\User;
+use App\Policies\ProjectPolicy;
+
+it('allows any user to view any projects', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new ProjectPolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows team member to view their own team project', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $project = Mockery::mock(Project::class)->makePartial();
+    $project->team_id = 1;
+
+    $policy = new ProjectPolicy;
+    expect($policy->view($user, $project))->toBeTrue();
+});
+
+it('denies non-member to view another team project', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $project = Mockery::mock(Project::class)->makePartial();
+    $project->team_id = 2;
+
+    $policy = new ProjectPolicy;
+    expect($policy->view($user, $project))->toBeFalse();
+});
+
+it('allows admin to create a project', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ProjectPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies member to create a project', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ProjectPolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows team admin to update their own team project', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $project = Mockery::mock(Project::class)->makePartial();
+    $project->team_id = 1;
+
+    $policy = new ProjectPolicy;
+    expect($policy->update($user, $project))->toBeTrue();
+});
+
+it('denies team member to update their own team project', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $project = Mockery::mock(Project::class)->makePartial();
+    $project->team_id = 1;
+
+    $policy = new ProjectPolicy;
+    expect($policy->update($user, $project))->toBeFalse();
+});
+
+it('allows team admin to delete their own team project', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $project = Mockery::mock(Project::class)->makePartial();
+    $project->team_id = 1;
+
+    $policy = new ProjectPolicy;
+    expect($policy->delete($user, $project))->toBeTrue();
+});
+
+it('denies team member to delete their own team project', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $project = Mockery::mock(Project::class)->makePartial();
+    $project->team_id = 1;
+
+    $policy = new ProjectPolicy;
+    expect($policy->delete($user, $project))->toBeFalse();
+});
+
+it('denies restore for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $project = Mockery::mock(Project::class)->makePartial();
+    $project->team_id = 1;
+
+    $policy = new ProjectPolicy;
+    expect($policy->restore($user, $project))->toBeFalse();
+});
+
+it('denies force delete for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $project = Mockery::mock(Project::class)->makePartial();
+    $project->team_id = 1;
+
+    $policy = new ProjectPolicy;
+    expect($policy->forceDelete($user, $project))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/ResourceCreatePolicyTest.php b/tests/Unit/Policies/ResourceCreatePolicyTest.php
new file mode 100644
index 000000000..606535467
--- /dev/null
+++ b/tests/Unit/Policies/ResourceCreatePolicyTest.php
@@ -0,0 +1,61 @@
+<?php
+
+use App\Models\Application;
+use App\Models\User;
+use App\Policies\ResourceCreatePolicy;
+
+it('allows admin to create any resource', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ResourceCreatePolicy;
+    expect($policy->createAny($user))->toBeTrue();
+});
+
+it('denies member from creating any resource', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ResourceCreatePolicy;
+    expect($policy->createAny($user))->toBeFalse();
+});
+
+it('allows admin to create a valid resource class', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ResourceCreatePolicy;
+    expect($policy->create($user, Application::class))->toBeTrue();
+});
+
+it('denies member from creating a valid resource class', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ResourceCreatePolicy;
+    expect($policy->create($user, Application::class))->toBeFalse();
+});
+
+it('denies admin from creating an invalid resource class', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ResourceCreatePolicy;
+    expect($policy->create($user, 'App\Models\NonExistent'))->toBeFalse();
+});
+
+it('allows admin to authorize all resource creation', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ResourceCreatePolicy;
+    expect($policy->authorizeAllResourceCreation($user))->toBeTrue();
+});
+
+it('denies member from authorizing all resource creation', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ResourceCreatePolicy;
+    expect($policy->authorizeAllResourceCreation($user))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/S3StoragePolicyTest.php b/tests/Unit/Policies/S3StoragePolicyTest.php
index 4ea580d0f..70ffdf718 100644
--- a/tests/Unit/Policies/S3StoragePolicyTest.php
+++ b/tests/Unit/Policies/S3StoragePolicyTest.php
@@ -52,7 +52,23 @@ it('allows team admin to update S3 storage from their team', function () {
     expect($policy->update($user, $storage))->toBeTrue();
 });
 
-it('denies team member to update S3 storage from another team', function () {
+it('denies team member to update S3 storage from their team', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $storage = Mockery::mock(S3Storage::class)->makePartial();
+    $storage->shouldReceive('getAttribute')->with('team_id')->andReturn(1);
+    $storage->team_id = 1;
+
+    $policy = new S3StoragePolicy;
+    expect($policy->update($user, $storage))->toBeFalse();
+});
+
+it('denies team admin to update S3 storage from another team', function () {
     $teams = collect([
         (object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
     ]);
@@ -68,9 +84,9 @@ it('denies team member to update S3 storage from another team', function () {
     expect($policy->update($user, $storage))->toBeFalse();
 });
 
-it('allows team member to delete S3 storage from their team', function () {
+it('allows team admin to delete S3 storage from their team', function () {
     $teams = collect([
-        (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
     ]);
 
     $user = Mockery::mock(User::class)->makePartial();
@@ -84,7 +100,23 @@ it('allows team member to delete S3 storage from their team', function () {
     expect($policy->delete($user, $storage))->toBeTrue();
 });
 
-it('denies team member to delete S3 storage from another team', function () {
+it('denies team member to delete S3 storage from their team', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $storage = Mockery::mock(S3Storage::class)->makePartial();
+    $storage->shouldReceive('getAttribute')->with('team_id')->andReturn(1);
+    $storage->team_id = 1;
+
+    $policy = new S3StoragePolicy;
+    expect($policy->delete($user, $storage))->toBeFalse();
+});
+
+it('denies team admin to delete S3 storage from another team', function () {
     $teams = collect([
         (object) ['id' => 1, 'pivot' => (object) ['role' => 'owner']],
     ]);
@@ -116,9 +148,9 @@ it('denies non-admin to create S3 storage', function () {
     expect($policy->create($user))->toBeFalse();
 });
 
-it('allows team member to validate connection of S3 storage from their team', function () {
+it('allows team admin to validate connection of S3 storage from their team', function () {
     $teams = collect([
-        (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
     ]);
 
     $user = Mockery::mock(User::class)->makePartial();
@@ -132,7 +164,23 @@ it('allows team member to validate connection of S3 storage from their team', fu
     expect($policy->validateConnection($user, $storage))->toBeTrue();
 });
 
-it('denies team member to validate connection of S3 storage from another team', function () {
+it('denies team member to validate connection of S3 storage from their team', function () {
+    $teams = collect([
+        (object) ['id' => 1, 'pivot' => (object) ['role' => 'member']],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $storage = Mockery::mock(S3Storage::class)->makePartial();
+    $storage->shouldReceive('getAttribute')->with('team_id')->andReturn(1);
+    $storage->team_id = 1;
+
+    $policy = new S3StoragePolicy;
+    expect($policy->validateConnection($user, $storage))->toBeFalse();
+});
+
+it('denies team admin to validate connection of S3 storage from another team', function () {
     $teams = collect([
         (object) ['id' => 1, 'pivot' => (object) ['role' => 'admin']],
     ]);
diff --git a/tests/Unit/Policies/ServerPolicyTest.php b/tests/Unit/Policies/ServerPolicyTest.php
new file mode 100644
index 000000000..d9084694a
--- /dev/null
+++ b/tests/Unit/Policies/ServerPolicyTest.php
@@ -0,0 +1,169 @@
+<?php
+
+use App\Models\Server;
+use App\Models\User;
+use App\Policies\ServerPolicy;
+
+it('allows any user to view any servers', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new ServerPolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows team member to view their own team server', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 1;
+
+    $policy = new ServerPolicy;
+    expect($policy->view($user, $server))->toBeTrue();
+});
+
+it('denies non-member to view another team server', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 2;
+
+    $policy = new ServerPolicy;
+    expect($policy->view($user, $server))->toBeFalse();
+});
+
+it('allows admin to create a server', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ServerPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies member to create a server', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ServerPolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows team admin to update their own team server', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 1;
+
+    $policy = new ServerPolicy;
+    expect($policy->update($user, $server))->toBeTrue();
+});
+
+it('denies team member to update their own team server', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 1;
+
+    $policy = new ServerPolicy;
+    expect($policy->update($user, $server))->toBeFalse();
+});
+
+it('allows team admin to delete their own team server', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 1;
+
+    $policy = new ServerPolicy;
+    expect($policy->delete($user, $server))->toBeTrue();
+});
+
+it('denies team member to delete their own team server', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 1;
+
+    $policy = new ServerPolicy;
+    expect($policy->delete($user, $server))->toBeFalse();
+});
+
+it('denies restore for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 1;
+
+    $policy = new ServerPolicy;
+    expect($policy->restore($user, $server))->toBeFalse();
+});
+
+it('denies force delete for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 1;
+
+    $policy = new ServerPolicy;
+    expect($policy->forceDelete($user, $server))->toBeFalse();
+});
+
+it('allows team admin to manage proxy', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 1;
+
+    $policy = new ServerPolicy;
+    expect($policy->manageProxy($user, $server))->toBeTrue();
+});
+
+it('denies team member to manage proxy', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 1;
+
+    $policy = new ServerPolicy;
+    expect($policy->manageProxy($user, $server))->toBeFalse();
+});
+
+it('allows team admin to manage sentinel, ca certificate, and view security', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 1;
+
+    $policy = new ServerPolicy;
+    expect($policy->manageSentinel($user, $server))->toBeTrue();
+    expect($policy->viewSentinel($user, $server))->toBeTrue();
+    expect($policy->manageCaCertificate($user, $server))->toBeTrue();
+    expect($policy->viewSecurity($user, $server))->toBeTrue();
+});
+
+it('denies team member to view sentinel', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->team_id = 1;
+
+    $policy = new ServerPolicy;
+    expect($policy->viewSentinel($user, $server))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/ServiceApplicationPolicyTest.php b/tests/Unit/Policies/ServiceApplicationPolicyTest.php
new file mode 100644
index 000000000..37d68c73e
--- /dev/null
+++ b/tests/Unit/Policies/ServiceApplicationPolicyTest.php
@@ -0,0 +1,37 @@
+<?php
+
+use App\Models\ServiceApplication;
+use App\Models\User;
+use App\Policies\ServiceApplicationPolicy;
+
+it('allows admin to create service application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ServiceApplicationPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies member from creating service application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ServiceApplicationPolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('denies restore for service application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $serviceApp = Mockery::mock(ServiceApplication::class)->makePartial();
+
+    $policy = new ServiceApplicationPolicy;
+    expect($policy->restore($user, $serviceApp))->toBeFalse();
+});
+
+it('denies force delete for service application', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $serviceApp = Mockery::mock(ServiceApplication::class)->makePartial();
+
+    $policy = new ServiceApplicationPolicy;
+    expect($policy->forceDelete($user, $serviceApp))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/ServiceDatabasePolicyTest.php b/tests/Unit/Policies/ServiceDatabasePolicyTest.php
new file mode 100644
index 000000000..44ddd3942
--- /dev/null
+++ b/tests/Unit/Policies/ServiceDatabasePolicyTest.php
@@ -0,0 +1,37 @@
+<?php
+
+use App\Models\ServiceDatabase;
+use App\Models\User;
+use App\Policies\ServiceDatabasePolicy;
+
+it('allows admin to create service database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ServiceDatabasePolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies member from creating service database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ServiceDatabasePolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('denies restore for service database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $serviceDb = Mockery::mock(ServiceDatabase::class)->makePartial();
+
+    $policy = new ServiceDatabasePolicy;
+    expect($policy->restore($user, $serviceDb))->toBeFalse();
+});
+
+it('denies force delete for service database', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $serviceDb = Mockery::mock(ServiceDatabase::class)->makePartial();
+
+    $policy = new ServiceDatabasePolicy;
+    expect($policy->forceDelete($user, $serviceDb))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/ServicePolicyTest.php b/tests/Unit/Policies/ServicePolicyTest.php
new file mode 100644
index 000000000..166fbc617
--- /dev/null
+++ b/tests/Unit/Policies/ServicePolicyTest.php
@@ -0,0 +1,233 @@
+<?php
+
+use App\Models\Service;
+use App\Models\User;
+use App\Policies\ServicePolicy;
+
+it('allows any user to view any services', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new ServicePolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows team member to view their own team service', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->view($user, $service))->toBeTrue();
+});
+
+it('denies non-member to view another team service', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 2]);
+
+    $policy = new ServicePolicy;
+    expect($policy->view($user, $service))->toBeFalse();
+});
+
+it('denies view when service has no team', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn(null);
+
+    $policy = new ServicePolicy;
+    expect($policy->view($user, $service))->toBeFalse();
+});
+
+it('allows admin to create a service', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new ServicePolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies member to create a service', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new ServicePolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows team admin to update their own team service', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->update($user, $service))->toBeTrue();
+});
+
+it('denies team member to update their own team service', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->update($user, $service))->toBeFalse();
+});
+
+it('allows team admin to delete their own team service', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->delete($user, $service))->toBeTrue();
+});
+
+it('denies team member to delete their own team service', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->delete($user, $service))->toBeFalse();
+});
+
+it('denies delete when service has no team', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn(null);
+
+    $policy = new ServicePolicy;
+    expect($policy->delete($user, $service))->toBeFalse();
+});
+
+it('allows team admin to deploy their own team service', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->deploy($user, $service))->toBeTrue();
+});
+
+it('denies team member to deploy their own team service', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->deploy($user, $service))->toBeFalse();
+});
+
+it('allows team admin to stop their own team service', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->stop($user, $service))->toBeTrue();
+});
+
+it('denies team member to stop their own team service', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->stop($user, $service))->toBeFalse();
+});
+
+it('allows team admin to manage service environment variables', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->manageEnvironment($user, $service))->toBeTrue();
+});
+
+it('denies team member to manage service environment variables', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->manageEnvironment($user, $service))->toBeFalse();
+});
+
+it('allows team admin to access terminal', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->accessTerminal($user, $service))->toBeTrue();
+});
+
+it('denies team member to access terminal', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->shouldReceive('team')->andReturn((object) ['id' => 1]);
+
+    $policy = new ServicePolicy;
+    expect($policy->accessTerminal($user, $service))->toBeFalse();
+});
+
+it('denies restore for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $service = Mockery::mock(Service::class)->makePartial();
+
+    $policy = new ServicePolicy;
+    expect($policy->restore($user, $service))->toBeFalse();
+});
+
+it('denies force delete for any user', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $service = Mockery::mock(Service::class)->makePartial();
+
+    $policy = new ServicePolicy;
+    expect($policy->forceDelete($user, $service))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/SharedEnvironmentVariablePolicyTest.php b/tests/Unit/Policies/SharedEnvironmentVariablePolicyTest.php
index f993978f9..d2a287a51 100644
--- a/tests/Unit/Policies/SharedEnvironmentVariablePolicyTest.php
+++ b/tests/Unit/Policies/SharedEnvironmentVariablePolicyTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Models\SharedEnvironmentVariable;
 use App\Models\User;
 use App\Policies\SharedEnvironmentVariablePolicy;
 
@@ -18,10 +19,7 @@ it('allows team member to view their team shared environment variable', function
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $model = new class
-    {
-        public $team_id = 1;
-    };
+    $model = mockSharedEnvironmentVariable(teamId: 1);
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->view($user, $model))->toBeTrue();
@@ -35,10 +33,7 @@ it('denies non-team member to view shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
 
-    $model = new class
-    {
-        public $team_id = 2;
-    };
+    $model = mockSharedEnvironmentVariable(teamId: 2);
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->view($user, $model))->toBeFalse();
@@ -64,10 +59,7 @@ it('allows team admin to update shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
 
-    $model = new class
-    {
-        public $team_id = 1;
-    };
+    $model = mockSharedEnvironmentVariable(teamId: 1);
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->update($user, $model))->toBeTrue();
@@ -77,10 +69,7 @@ it('denies team member to update shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
 
-    $model = new class
-    {
-        public $team_id = 1;
-    };
+    $model = mockSharedEnvironmentVariable(teamId: 1);
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->update($user, $model))->toBeFalse();
@@ -90,10 +79,7 @@ it('allows team admin to delete shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
 
-    $model = new class
-    {
-        public $team_id = 1;
-    };
+    $model = mockSharedEnvironmentVariable(teamId: 1);
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->delete($user, $model))->toBeTrue();
@@ -103,10 +89,7 @@ it('denies team member to delete shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
 
-    $model = new class
-    {
-        public $team_id = 1;
-    };
+    $model = mockSharedEnvironmentVariable(teamId: 1);
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->delete($user, $model))->toBeFalse();
@@ -115,10 +98,7 @@ it('denies team member to delete shared environment variable', function () {
 it('denies restore of shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
 
-    $model = new class
-    {
-        public $team_id = 1;
-    };
+    $model = mockSharedEnvironmentVariable(teamId: 1);
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->restore($user, $model))->toBeFalse();
@@ -127,10 +107,7 @@ it('denies restore of shared environment variable', function () {
 it('denies force delete of shared environment variable', function () {
     $user = Mockery::mock(User::class)->makePartial();
 
-    $model = new class
-    {
-        public $team_id = 1;
-    };
+    $model = mockSharedEnvironmentVariable(teamId: 1);
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->forceDelete($user, $model))->toBeFalse();
@@ -140,10 +117,7 @@ it('allows team admin to manage environment', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
 
-    $model = new class
-    {
-        public $team_id = 1;
-    };
+    $model = mockSharedEnvironmentVariable(teamId: 1);
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->manageEnvironment($user, $model))->toBeTrue();
@@ -153,11 +127,16 @@ it('denies team member to manage environment', function () {
     $user = Mockery::mock(User::class)->makePartial();
     $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
 
-    $model = new class
-    {
-        public $team_id = 1;
-    };
+    $model = mockSharedEnvironmentVariable(teamId: 1);
 
     $policy = new SharedEnvironmentVariablePolicy;
     expect($policy->manageEnvironment($user, $model))->toBeFalse();
 });
+
+function mockSharedEnvironmentVariable(int $teamId): SharedEnvironmentVariable
+{
+    $sharedEnvironmentVariable = Mockery::mock(SharedEnvironmentVariable::class)->makePartial();
+    $sharedEnvironmentVariable->team_id = $teamId;
+
+    return $sharedEnvironmentVariable;
+}
diff --git a/tests/Unit/Policies/StandaloneDockerPolicyTest.php b/tests/Unit/Policies/StandaloneDockerPolicyTest.php
new file mode 100644
index 000000000..750aff6c2
--- /dev/null
+++ b/tests/Unit/Policies/StandaloneDockerPolicyTest.php
@@ -0,0 +1,122 @@
+<?php
+
+use App\Models\StandaloneDocker;
+use App\Models\User;
+use App\Policies\StandaloneDockerPolicy;
+
+it('allows any user to view any standalone docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new StandaloneDockerPolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows team member to view their team standalone docker', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $standaloneDocker = Mockery::mock(StandaloneDocker::class)->makePartial();
+    $standaloneDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new StandaloneDockerPolicy;
+    expect($policy->view($user, $standaloneDocker))->toBeTrue();
+});
+
+it('denies user from viewing another team standalone docker', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $standaloneDocker = Mockery::mock(StandaloneDocker::class)->makePartial();
+    $standaloneDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 2]);
+
+    $policy = new StandaloneDockerPolicy;
+    expect($policy->view($user, $standaloneDocker))->toBeFalse();
+});
+
+it('allows admin to create standalone docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new StandaloneDockerPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies non-admin from creating standalone docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new StandaloneDockerPolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows team admin to update standalone docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $standaloneDocker = Mockery::mock(StandaloneDocker::class)->makePartial();
+    $standaloneDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new StandaloneDockerPolicy;
+    expect($policy->update($user, $standaloneDocker))->toBeTrue();
+});
+
+it('denies non-admin from updating standalone docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $standaloneDocker = Mockery::mock(StandaloneDocker::class)->makePartial();
+    $standaloneDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new StandaloneDockerPolicy;
+    expect($policy->update($user, $standaloneDocker))->toBeFalse();
+});
+
+it('allows team admin to delete standalone docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $standaloneDocker = Mockery::mock(StandaloneDocker::class)->makePartial();
+    $standaloneDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new StandaloneDockerPolicy;
+    expect($policy->delete($user, $standaloneDocker))->toBeTrue();
+});
+
+it('denies non-admin from deleting standalone docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $standaloneDocker = Mockery::mock(StandaloneDocker::class)->makePartial();
+    $standaloneDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new StandaloneDockerPolicy;
+    expect($policy->delete($user, $standaloneDocker))->toBeFalse();
+});
+
+it('denies restore for standalone docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $standaloneDocker = Mockery::mock(StandaloneDocker::class)->makePartial();
+    $standaloneDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new StandaloneDockerPolicy;
+    expect($policy->restore($user, $standaloneDocker))->toBeFalse();
+});
+
+it('denies force delete for standalone docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $standaloneDocker = Mockery::mock(StandaloneDocker::class)->makePartial();
+    $standaloneDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new StandaloneDockerPolicy;
+    expect($policy->forceDelete($user, $standaloneDocker))->toBeFalse();
+});
diff --git a/tests/Unit/Policies/SwarmDockerPolicyTest.php b/tests/Unit/Policies/SwarmDockerPolicyTest.php
new file mode 100644
index 000000000..f1b060086
--- /dev/null
+++ b/tests/Unit/Policies/SwarmDockerPolicyTest.php
@@ -0,0 +1,122 @@
+<?php
+
+use App\Models\SwarmDocker;
+use App\Models\User;
+use App\Policies\SwarmDockerPolicy;
+
+it('allows any user to view any swarm docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $policy = new SwarmDockerPolicy;
+    expect($policy->viewAny($user))->toBeTrue();
+});
+
+it('allows team member to view their team swarm docker', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $swarmDocker = Mockery::mock(SwarmDocker::class)->makePartial();
+    $swarmDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new SwarmDockerPolicy;
+    expect($policy->view($user, $swarmDocker))->toBeTrue();
+});
+
+it('denies user from viewing another team swarm docker', function () {
+    $teams = collect([
+        (object) ['id' => 1],
+    ]);
+
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('getAttribute')->with('teams')->andReturn($teams);
+
+    $swarmDocker = Mockery::mock(SwarmDocker::class)->makePartial();
+    $swarmDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 2]);
+
+    $policy = new SwarmDockerPolicy;
+    expect($policy->view($user, $swarmDocker))->toBeFalse();
+});
+
+it('allows admin to create swarm docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(true);
+
+    $policy = new SwarmDockerPolicy;
+    expect($policy->create($user))->toBeTrue();
+});
+
+it('denies non-admin from creating swarm docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdmin')->andReturn(false);
+
+    $policy = new SwarmDockerPolicy;
+    expect($policy->create($user))->toBeFalse();
+});
+
+it('allows team admin to update swarm docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $swarmDocker = Mockery::mock(SwarmDocker::class)->makePartial();
+    $swarmDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new SwarmDockerPolicy;
+    expect($policy->update($user, $swarmDocker))->toBeTrue();
+});
+
+it('denies non-admin from updating swarm docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $swarmDocker = Mockery::mock(SwarmDocker::class)->makePartial();
+    $swarmDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new SwarmDockerPolicy;
+    expect($policy->update($user, $swarmDocker))->toBeFalse();
+});
+
+it('allows team admin to delete swarm docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(true);
+
+    $swarmDocker = Mockery::mock(SwarmDocker::class)->makePartial();
+    $swarmDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new SwarmDockerPolicy;
+    expect($policy->delete($user, $swarmDocker))->toBeTrue();
+});
+
+it('denies non-admin from deleting swarm docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+    $user->shouldReceive('isAdminOfTeam')->with(1)->andReturn(false);
+
+    $swarmDocker = Mockery::mock(SwarmDocker::class)->makePartial();
+    $swarmDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new SwarmDockerPolicy;
+    expect($policy->delete($user, $swarmDocker))->toBeFalse();
+});
+
+it('denies restore for swarm docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $swarmDocker = Mockery::mock(SwarmDocker::class)->makePartial();
+    $swarmDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new SwarmDockerPolicy;
+    expect($policy->restore($user, $swarmDocker))->toBeFalse();
+});
+
+it('denies force delete for swarm docker', function () {
+    $user = Mockery::mock(User::class)->makePartial();
+
+    $swarmDocker = Mockery::mock(SwarmDocker::class)->makePartial();
+    $swarmDocker->shouldReceive('getAttribute')->with('server')->andReturn((object) ['team_id' => 1]);
+
+    $policy = new SwarmDockerPolicy;
+    expect($policy->forceDelete($user, $swarmDocker))->toBeFalse();
+});
diff --git a/tests/Unit/PublicIdTest.php b/tests/Unit/PublicIdTest.php
new file mode 100644
index 000000000..027d46e57
--- /dev/null
+++ b/tests/Unit/PublicIdTest.php
@@ -0,0 +1,19 @@
+<?php
+
+it('generates lowercase URL-safe public ids without Cuid2', function () {
+    $ids = collect(range(1, 100))->map(fn () => new_public_id());
+
+    expect($ids)->each
+        ->toBeString()
+        ->toHaveLength(24)
+        ->toMatch('/^[a-z0-9]+$/');
+
+    expect($ids->unique())->toHaveCount(100);
+});
+
+it('honors custom public id lengths', function () {
+    expect(new_public_id(32))
+        ->toBeString()
+        ->toHaveLength(32)
+        ->toMatch('/^[a-z0-9]+$/');
+});
diff --git a/tests/v4/Browser/AuthorizationTest.php b/tests/v4/Browser/AuthorizationTest.php
new file mode 100644
index 000000000..cb26b73a9
--- /dev/null
+++ b/tests/v4/Browser/AuthorizationTest.php
@@ -0,0 +1,447 @@
+<?php
+
+use App\Enums\ProxyStatus;
+use App\Enums\ProxyTypes;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::create(['id' => 0, 'is_sponsorship_popup_enabled' => false]);
+
+    // Create root/owner user
+    $this->user = User::factory()->create([
+        'id' => 0,
+        'name' => 'Root User',
+        'email' => 'test@example.com',
+        'password' => Hash::make('password'),
+    ]);
+
+    // Create SSH key for the root user's team
+    PrivateKey::create([
+        'id' => 1,
+        'uuid' => 'ssh-test',
+        'team_id' => 0,
+        'name' => 'Test Key',
+        'description' => 'Test SSH key',
+        'private_key' => '-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi/QySHv0Mk
+hwAAAAtzc2gtZWQyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevA
+AAAECBQw4jg1WRT2IGHMncCiZhURCts2s24HoDS0thHnnRKVuGmoeGq/pojrsyP1pszcNV
+uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
+-----END OPENSSH PRIVATE KEY-----',
+    ]);
+
+    // Create servers for testing
+    Server::create([
+        'id' => 0,
+        'uuid' => 'localhost',
+        'name' => 'localhost',
+        'description' => 'Test docker container in development',
+        'ip' => 'coolify-testing-host',
+        'team_id' => 0,
+        'private_key_id' => 1,
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => ProxyStatus::EXITED->value,
+        ],
+    ]);
+
+    Server::create([
+        'uuid' => 'production-1',
+        'name' => 'production-web',
+        'description' => 'Production web server',
+        'ip' => '10.0.0.1',
+        'team_id' => 0,
+        'private_key_id' => 1,
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => ProxyStatus::EXITED->value,
+        ],
+    ]);
+
+    // Create projects for testing
+    Project::create([
+        'uuid' => 'project-1',
+        'name' => 'My first project',
+        'description' => 'This is a test project',
+        'team_id' => 0,
+    ]);
+
+    Project::create([
+        'uuid' => 'project-2',
+        'name' => 'Production API',
+        'description' => 'Backend services',
+        'team_id' => 0,
+    ]);
+
+    // Create a member user attached to root team only
+    $this->member = User::factory()->create([
+        'name' => 'Member User',
+        'email' => 'member@example.com',
+        'password' => Hash::make('password'),
+    ]);
+    // Remove auto-created personal team so member only belongs to root team
+    $personalTeam = $this->member->teams()->first();
+    $this->member->teams()->detach($personalTeam->id);
+    $personalTeam->delete();
+    // Attach member to root team (id=0) with 'member' role
+    $this->member->teams()->attach(0, ['role' => 'member']);
+});
+
+function loginAsMember(): mixed
+{
+    return visit('/login')
+        ->fill('email', 'member@example.com')
+        ->fill('password', 'password')
+        ->click('Login');
+}
+
+it('redirects unauthenticated users to login', function () {
+    $page = visit('/dashboard');
+
+    $page->assertPathIs('/login')
+        ->screenshot();
+});
+
+it('shows dashboard after successful login and onboarding skip', function () {
+    $page = loginAndSkipBoarding();
+
+    $page->assertSee('Dashboard')
+        ->assertSee('Your self-hosted infrastructure')
+        ->screenshot();
+});
+
+it('displays all projects on dashboard', function () {
+    $page = loginAndSkipBoarding();
+
+    $page->assertSee('Projects')
+        ->assertSee('My first project')
+        ->assertSee('This is a test project')
+        ->assertSee('Production API')
+        ->assertSee('Backend services')
+        ->screenshot();
+});
+
+it('displays all servers on dashboard', function () {
+    $page = loginAndSkipBoarding();
+
+    $page->assertSee('Servers')
+        ->assertSee('localhost')
+        ->assertSee('Test docker container in development')
+        ->assertSee('production-web')
+        ->assertSee('Production web server')
+        ->screenshot();
+});
+
+it('allows authenticated users to access team settings', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/team');
+
+    $page->assertSee('General')
+        ->assertSee('Manage the general settings of this team')
+        ->screenshot();
+});
+
+it('shows danger zone to team owner', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/team');
+
+    $page->assertSee('Danger Zone')
+        ->assertSee('Delete Team')
+        ->screenshot();
+});
+
+it('prevents unauthenticated access to team settings', function () {
+    $page = visit('/team');
+
+    $page->assertPathIs('/login')
+        ->screenshot();
+});
+
+it('prevents unauthenticated access to server show page', function () {
+    $server = Server::first();
+    $page = visit("/server/{$server->uuid}");
+
+    $page->assertPathIs('/login')
+        ->screenshot();
+});
+
+it('prevents unauthenticated access to project show page', function () {
+    $project = Project::first();
+    $page = visit("/project/{$project->uuid}");
+
+    $page->assertPathIs('/login')
+        ->screenshot();
+});
+
+it('authenticated user can navigate to server details', function () {
+    loginAndSkipBoarding();
+
+    // Navigate to server show page using UUID
+    $server = Server::first();
+    $page = visit("/server/{$server->uuid}");
+
+    // Server page should load without redirect
+    $page->assertSee('localhost')
+        ->screenshot();
+});
+
+it('authenticated user can navigate to project details', function () {
+    loginAndSkipBoarding();
+
+    // Navigate to project show page using UUID
+    $project = Project::first();
+    $page = visit("/project/{$project->uuid}");
+
+    // Project page should load without redirect
+    $page->assertSee('My first project')
+        ->screenshot();
+});
+
+it('prevents unauthenticated access to team members page', function () {
+    $page = visit('/team/members');
+
+    $page->assertPathIs('/login')
+        ->screenshot();
+});
+
+it('authenticated user can access team members page', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/team/members');
+
+    $page->assertSee('Members')
+        ->screenshot();
+});
+
+// --- Negative authorization tests (member role) ---
+
+it('member does not see add project button on dashboard', function () {
+    $page = loginAsMember();
+
+    $page->assertSee('Projects')
+        ->assertDontSee('New Project')
+        ->screenshot();
+});
+
+it('member does not see add server button on dashboard', function () {
+    $page = loginAsMember();
+
+    $page->assertSee('Servers')
+        ->assertDontSee('New Server')
+        ->screenshot();
+});
+
+it('member does not see danger zone on team settings', function () {
+    loginAsMember();
+
+    $page = visit('/team');
+
+    $page->assertSee('General')
+        ->assertDontSee('Danger Zone')
+        ->assertDontSee('Delete Team')
+        ->screenshot();
+});
+
+// --- Server page authorization tests ---
+
+it('member does not see terminal link on server page', function () {
+    loginAsMember();
+
+    $server = Server::first();
+    $page = visit("/server/{$server->uuid}");
+
+    $page->assertSee('Configuration')
+        ->assertDontSee('Terminal')
+        ->screenshot();
+});
+
+it('member does not see security link on server page', function () {
+    loginAsMember();
+
+    $server = Server::first();
+    $page = visit("/server/{$server->uuid}");
+
+    $page->assertSee('Configuration')
+        ->assertDontSee('Security')
+        ->screenshot();
+});
+
+it('member does not see proxy controls on server page', function () {
+    loginAsMember();
+
+    $server = Server::first();
+    $page = visit("/server/{$server->uuid}");
+
+    $page->assertSee('Configuration')
+        ->assertDontSee('Start Proxy')
+        ->assertDontSee('Restart Proxy')
+        ->assertDontSee('Stop Proxy')
+        ->screenshot();
+});
+
+it('owner sees terminal and security links on server page', function () {
+    loginAndSkipBoarding();
+
+    $server = Server::first();
+    $page = visit("/server/{$server->uuid}");
+
+    $page->assertSee('Configuration')
+        ->assertSee('Terminal')
+        ->assertSee('Security')
+        ->screenshot();
+});
+
+// Note: Proxy controls (Start/Stop/Restart Proxy) require server.isFunctional()=true
+// which needs is_reachable=true and is_usable=true in server settings.
+// Testing proxy button visibility is covered by the member test above (proxy controls
+// are behind @can('manageProxy', $server) which is admin-only).
+
+// --- Project page authorization tests ---
+
+it('member does not see add environment button on project page', function () {
+    loginAsMember();
+
+    $project = Project::where('uuid', 'project-1')->first();
+    $page = visit("/project/{$project->uuid}");
+
+    $page->assertSee('Environments')
+        ->assertDontSee('+ Add')
+        ->screenshot();
+});
+
+it('member does not see environment settings link on project page', function () {
+    loginAsMember();
+
+    $project = Project::where('uuid', 'project-1')->first();
+    $page = visit("/project/{$project->uuid}");
+
+    $page->assertSee('Environments')
+        ->assertDontSee('Settings')
+        ->screenshot();
+});
+
+it('owner sees add environment and settings on project page', function () {
+    loginAndSkipBoarding();
+
+    $project = Project::where('uuid', 'project-1')->first();
+    $page = visit("/project/{$project->uuid}");
+
+    $page->assertSee('Environments')
+        ->assertSee('+ Add')
+        ->assertSee('Settings')
+        ->screenshot();
+});
+
+// --- Dashboard: resource links authorization ---
+
+it('member does not see add resource link on dashboard project cards', function () {
+    $page = loginAsMember();
+
+    $page->assertSee('Projects')
+        ->assertSee('My first project')
+        ->assertDontSee('+ Add Resource')
+        ->screenshot();
+});
+
+it('owner sees add resource link on dashboard project cards', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/dashboard');
+
+    $page->assertSee('Projects')
+        ->assertSee('My first project')
+        ->assertSee('+ Add Resource')
+        ->screenshot();
+});
+
+it('member does not see project settings link on dashboard', function () {
+    $page = loginAsMember();
+
+    // The "Settings" link is inside the project card on the dashboard
+    // Member should not see it due to @can('update', $project)
+    $page->assertSee('My first project')
+        ->assertDontSee('Settings')
+        ->screenshot();
+});
+
+// --- Team members page authorization ---
+
+it('member does not see invite form on team members page', function () {
+    loginAsMember();
+
+    $page = visit('/team/members');
+
+    $page->assertSee('Members')
+        ->assertDontSee('Invite New Member')
+        ->screenshot();
+});
+
+it('owner sees invite form on team members page', function () {
+    loginAndSkipBoarding();
+
+    $page = visit('/team/members');
+
+    $page->assertSee('Members')
+        ->assertSee('Invite New Member')
+        ->screenshot();
+});
+
+it('member does not see role change buttons on team members page', function () {
+    loginAsMember();
+
+    $page = visit('/team/members');
+
+    $page->assertSee('Members')
+        ->assertDontSee('To Admin')
+        ->assertDontSee('To Owner')
+        ->assertDontSee('Remove')
+        ->screenshot();
+});
+
+// --- Server show page authorization ---
+
+it('member does not see save button on server show page', function () {
+    loginAsMember();
+
+    $server = Server::first();
+    $page = visit("/server/{$server->uuid}");
+
+    $page->assertSee('General')
+        ->assertDontSee('Revalidate server')
+        ->screenshot();
+});
+
+it('owner sees save button on server show page', function () {
+    loginAndSkipBoarding();
+
+    $server = Server::first();
+    $page = visit("/server/{$server->uuid}");
+
+    $page->assertSee('General')
+        ->assertSee('Save')
+        ->screenshot();
+});
+
+// --- Project show page authorization ---
+
+it('member does not see delete project button on project page', function () {
+    loginAsMember();
+
+    $project = Project::where('uuid', 'project-1')->first();
+    $page = visit("/project/{$project->uuid}");
+
+    $page->assertSee('Environments')
+        ->assertDontSee('Delete Project')
+        ->screenshot();
+});
diff --git a/tests/v4/Browser/DashboardTest.php b/tests/v4/Browser/DashboardTest.php
index b4a97f268..d50fceb0b 100644
--- a/tests/v4/Browser/DashboardTest.php
+++ b/tests/v4/Browser/DashboardTest.php
@@ -13,7 +13,7 @@ use Illuminate\Support\Facades\Hash;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::create(['id' => 0]);
+    InstanceSettings::create(['id' => 0, 'is_sponsorship_popup_enabled' => false]);
 
     $this->user = User::factory()->create([
         'id' => 0,
@@ -99,15 +99,6 @@ uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
     ]);
 });
 
-function loginAndSkipOnboarding(): mixed
-{
-    return visit('/login')
-        ->fill('email', 'test@example.com')
-        ->fill('password', 'password')
-        ->click('Login')
-        ->click('Skip Setup');
-}
-
 it('redirects to login when not authenticated', function () {
     $page = visit('/');
 
@@ -128,7 +119,7 @@ it('shows onboarding after first login', function () {
 });
 
 it('shows dashboard after skipping onboarding', function () {
-    $page = loginAndSkipOnboarding();
+    $page = loginAndSkipBoarding();
 
     $page->assertSee('Dashboard')
         ->assertSee('Your self-hosted infrastructure.')
@@ -136,7 +127,7 @@ it('shows dashboard after skipping onboarding', function () {
 });
 
 it('shows all projects on dashboard', function () {
-    $page = loginAndSkipOnboarding();
+    $page = loginAndSkipBoarding();
 
     $page->assertSee('Projects')
         ->assertSee('My first project')
@@ -149,7 +140,7 @@ it('shows all projects on dashboard', function () {
 });
 
 it('shows servers on dashboard', function () {
-    $page = loginAndSkipOnboarding();
+    $page = loginAndSkipBoarding();
 
     $page->assertSee('Servers')
         ->assertSee('localhost')
diff --git a/tests/v4/Browser/LoginTest.php b/tests/v4/Browser/LoginTest.php
index 7666e07e2..716acd20a 100644
--- a/tests/v4/Browser/LoginTest.php
+++ b/tests/v4/Browser/LoginTest.php
@@ -8,7 +8,7 @@ use Illuminate\Support\Facades\Hash;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::create(['id' => 0]);
+    InstanceSettings::create(['id' => 0, 'is_sponsorship_popup_enabled' => false]);
 });
 
 it('shows registration page when no users exist', function () {
diff --git a/tests/v4/Browser/RegistrationTest.php b/tests/v4/Browser/RegistrationTest.php
index e2a232357..42a871257 100644
--- a/tests/v4/Browser/RegistrationTest.php
+++ b/tests/v4/Browser/RegistrationTest.php
@@ -7,7 +7,7 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::create(['id' => 0]);
+    InstanceSettings::create(['id' => 0, 'is_sponsorship_popup_enabled' => false]);
 });
 
 it('shows registration page when no users exist', function () {
diff --git a/tests/v4/Browser/ResourceSettingsPersistenceTest.php b/tests/v4/Browser/ResourceSettingsPersistenceTest.php
new file mode 100644
index 000000000..c9d698efc
--- /dev/null
+++ b/tests/v4/Browser/ResourceSettingsPersistenceTest.php
@@ -0,0 +1,180 @@
+<?php
+
+use App\Enums\ProxyStatus;
+use App\Enums\ProxyTypes;
+use App\Models\Application;
+use App\Models\DiscordNotificationSettings;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::create(['id' => 0, 'is_sponsorship_popup_enabled' => false]);
+
+    $this->user = User::factory()->create([
+        'id' => 0,
+        'name' => 'Root User',
+        'email' => 'test@example.com',
+        'password' => Hash::make('password'),
+    ]);
+
+    DiscordNotificationSettings::where('team_id', 0)->update([
+        'discord_enabled' => true,
+        'discord_webhook_url' => 'https://discord.com/test',
+    ]);
+
+    PrivateKey::create([
+        'id' => 1,
+        'uuid' => 'ssh-test',
+        'team_id' => 0,
+        'name' => 'Test Key',
+        'description' => 'Test SSH key',
+        'private_key' => '-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi/QySHv0Mk
+hwAAAAtzc2gtZWQyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevA
+AAAECBQw4jg1WRT2IGHMncCiZhURCts2s24HoDS0thHnnRKVuGmoeGq/pojrsyP1pszcNV
+uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
+-----END OPENSSH PRIVATE KEY-----',
+    ]);
+
+    $this->server = Server::create([
+        'id' => 0,
+        'uuid' => 'localhost',
+        'name' => 'localhost',
+        'description' => 'Test docker container in development',
+        'ip' => 'coolify-testing-host',
+        'team_id' => 0,
+        'private_key_id' => 1,
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => ProxyStatus::EXITED->value,
+        ],
+    ]);
+
+    $this->project = Project::create([
+        'uuid' => 'project-resource-persistence',
+        'name' => 'Resource Persistence',
+        'description' => 'Browser persistence tests',
+        'team_id' => 0,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => 'docker-destination-1', 'name' => 'docker-destination-1']
+        );
+    });
+
+    $this->application = Application::factory()->create([
+        'uuid' => 'app-resource-persistence',
+        'name' => 'App Before Browser Save',
+        'git_repository' => 'https://github.com/coollabsio/coolify.git',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->database = StandalonePostgresql::create([
+        'uuid' => 'db-resource-persistence',
+        'name' => 'Database Before Browser Save',
+        'description' => 'Initial database description',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'postgres-password',
+        'postgres_db' => 'postgres',
+        'image' => 'postgres:15-alpine',
+        'status' => 'exited',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+});
+
+it('saves application name and enables static site with nginx config', function () {
+    loginAndSkipBoarding();
+
+    $updatedName = 'App Saved '.(string) new Cuid2;
+    $applicationRoute = "/project/{$this->project->uuid}/environment/{$this->environment->uuid}/application/{$this->application->uuid}";
+
+    $page = visit($applicationRoute);
+    $page->screenshot();
+
+    $page->assertSee('General')
+        ->assertDontSee('Custom Nginx Configuration')
+        ->fill('name', $updatedName)
+        ->fill('customDockerRunOptions', '--read-only');
+
+    submitLivewireForm($page);
+    $page->click('[id^="isStatic"]')
+        ->wait(2)
+        ->screenshot();
+
+    $page->assertSourceHas('Custom Nginx Configuration')
+        ->assertSee('Is it a SPA (Single Page Application)?')
+        ->assertValue('name', $updatedName);
+
+    $this->application->refresh();
+    expect($this->application->name)->toBe($updatedName)
+        ->and($this->application->custom_docker_run_options)->toBe('--read-only')
+        ->and($this->application->settings->is_static)->toBeTrue();
+
+    $reloadedPage = visit($applicationRoute);
+    $reloadedPage->screenshot();
+
+    $reloadedPage->assertValue('name', $updatedName)
+        ->assertSourceHas('Custom Nginx Configuration')
+        ->assertSourceHas('Is it a SPA (Single Page Application)?');
+});
+
+it('saves database name and enables ssl with mode selector', function () {
+    loginAndSkipBoarding();
+
+    $updatedDatabaseName = 'Database Saved '.(string) new Cuid2;
+    $databaseRoute = "/project/{$this->project->uuid}/environment/{$this->environment->uuid}/database/{$this->database->uuid}";
+
+    $page = visit($databaseRoute);
+    $page->screenshot();
+
+    $page->assertSee('General')
+        ->assertDontSee('SSL Mode')
+        ->fill('name', $updatedDatabaseName)
+        ->fill('description', 'Updated by browser test');
+
+    submitLivewireForm($page);
+    $page->click('[id^="enableSsl"]');
+
+    $page->assertSee('SSL Mode')
+        ->assertValue('name', $updatedDatabaseName);
+    $page->screenshot();
+
+    $this->database->refresh();
+    expect($this->database->name)->toBe($updatedDatabaseName)
+        ->and($this->database->description)->toBe('Updated by browser test')
+        ->and($this->database->enable_ssl)->toBeTruthy();
+
+    $reloadedPage = visit($databaseRoute);
+    $reloadedPage->screenshot();
+
+    $reloadedPage->assertValue('name', $updatedDatabaseName)
+        ->assertSee('SSL Mode');
+});
+
+function submitLivewireForm($page): void
+{
+    $page->script("document.querySelector('form[wire\\\\:submit=\"submit\"]')?.requestSubmit()");
+    $page->wait(1);
+}