I would have thought it would be more like:
- Admin (domain.com/admin)
- Brands (domain.com/brand)
- Users (domain.com/user)
But all are users. Also look here and at other links in there. https://laracasts.com/discuss/channels/general-discussion/authorization-policies-and-reducing-the-repitition
and
https://laracasts.com/discuss/channels/laravel/security-in-controller
Usually a good RBAC with correct queries does the job.
For what you want also look at: https://github.com/spatie/laravel-permission