Handling permissions for roles of tenant application from central application.

I want to edit roles and permissions of tenant user (specifically for that role which is assigned when you create new tenant) from central application. Give me some rough idea about what will be the best practice to do so. I am using stancl/tenancy to achieve multi tenancy.