Best pratice to check user roles inside a policy

I have this idea to improve my policies. What about adding an edit method in the policy ?

public function edit(User $user, Room $room)
{
    return (in_array(0, session('roles')) || in_array(4, session('roles'))) && $room->company_id == session('current_company_id');
}

public function update(User $user, Room $room)
{
    return Role::where('collaborator_id', $user->current_collaborator_id)->whereIn('role', [0, 1])->exists() && $room->company_id == session('current_company_id');
}

Check the roles from the session just to display the menus, disable the buttons, ...

But for real update in the database, I retrieve all roles directly from the database.

Is it a good idea to do that ?

Here is what I have done.

I have added a middleware to the routes which need it. Thus this middleware is executed each time a request is done. It retrieves the different datas : roles, current_company_id, ... and put them in the session. Then I send these datas to the front as InertiaJS shared datas (essentially to hide some menus and buttons according to the roles).

In the backend, the policies use the session datas to check if a user can or cannot do an action. As the session datas are refreshed at each request via the middleware, I think that's it's secure enough to do like that.

If you want to comment this or help me to understand that it's perhaps not secure enough, don't hesitate.

Now that I have done all this code, I wonder if it would not be a better idea to use some package like Spatie roles and permissions. I never used it but I know that it's a good package.