Read my api.php top to bottom and you already know the permission model: three route tiers, no surprises

Open routes/api.php in a new project and you can usually tell within a minute whether the author thought about permissions or just bolted them on later. The giveaway is scattering: an auth middleware