diff --git a/src/lib/permissions.ts b/src/lib/permissions.ts
new file mode 100644
index 0000000..b2035d8
--- /dev/null
+++ b/src/lib/permissions.ts
@@ -0,0 +1,51 @@
+export type Permission =
+  | "dashboard:read"
+  | "tools:read"
+  | "websites:manage"
+  | "domains:manage"
+  | "files:manage"
+  | "databases:manage"
+  | "email:manage"
+  | "metrics:read"
+  | "security:manage"
+  | "software:manage"
+  | "advanced:manage"
+  | "servers:manage"
+  | "users:manage"
+  | "resellers:manage"
+  | "backups:manage"
+  | "automation:manage"
+  | "notifications:read"
+  | "audit:read"
+  | "support:manage"
+  | "settings:manage";
+
+export const rolePermissions: Record<string, Permission[]> = {
+  "Super administrator": [
+    "dashboard:read",
+    "tools:read",
+    "websites:manage",
+    "domains:manage",
+    "files:manage",
+    "databases:manage",
+    "email:manage",
+    "metrics:read",
+    "security:manage",
+    "software:manage",
+    "advanced:manage",
+    "servers:manage",
+    "users:manage",
+    "resellers:manage",
+    "backups:manage",
+    "automation:manage",
+    "notifications:read",
+    "audit:read",
+    "support:manage",
+    "settings:manage",
+  ],
+  "Read-only auditor": ["dashboard:read", "tools:read", "metrics:read", "audit:read"],
+};
+
+export function can(permissions: Permission[], permission: Permission) {
+  return permissions.includes(permission);
+}