Laravel Nova handles this particularly well, with separate "can see" and "can run" concerns. Nova is essential an admin panel for CRUD operations over your Laravel resources. Basically we use them this way:

"can see" = false: not a valid action (resource should not be created manually for example)

"can see" = true && "can run" = false: valid action in the system, user is not permitted to perform

"can see" = true && "can run" = true: valid action, user has access to perform