Best way to create a permission system

Best option would be policies: Backend customization - Strapi Developer Documentation