<p class="text-faint">Controls what each role can do beyond the basics every agent has (view tickets, reply, add internal notes). <strong>Administrator</strong> is not shown here — it always has full access, so the matrix can never lock every account out of the system.</p>

<form method="post" action="<?= url('/admin/permissions') ?>">
  <?= csrf_field() ?>
  <div class="card">
    <div class="table-wrap">
      <table class="table">
        <thead>
          <tr>
            <th style="min-width:220px">Permission</th>
            <?php foreach ($roles as $role) : ?><th style="text-align:center"><?= e($role['name']) ?></th><?php endforeach; ?>
          </tr>
        </thead>
        <tbody>
        <?php foreach ($permissions as $key => $meta) : ?>
          <tr>
            <td>
              <div style="font-weight:650"><?= e($meta['label']) ?></div>
              <div class="text-faint text-sm"><?= e($meta['description']) ?></div>
            </td>
            <?php foreach ($roles as $role) : ?>
              <td style="text-align:center">
                <input type="checkbox" name="grant[<?= $role['id'] ?>][]" value="<?= e($key) ?>"
                  <?= isset($grantedSet[$role['id'] . ':' . $key]) ? 'checked' : '' ?>
                  style="width:18px;height:18px">
              </td>
            <?php endforeach; ?>
          </tr>
        <?php endforeach; ?>
        <?php if (empty($permissions)) : ?><tr><td colspan="<?= count($roles) + 1 ?>" class="text-faint">No permissions defined.</td></tr><?php endif; ?>
        </tbody>
      </table>
    </div>
    <div class="card-body">
      <button type="submit" class="btn btn-primary">Save permissions</button>
    </div>
  </div>
</form>
