Complex permissions (hundreds of permissions/dozens roles)

Just wondering if anyone has tactics to handle larger sets of permissions. Developing an app with 250 permissions and 20 roles (which will probably increase).

Using spatie/laravel-permissions with Policy classes is good so far, but as it gets more complex I think it will become harder to maintain. For example - each permission has a corresponding policy method that will check other business logic. So even if a user has a permission it doesn't mean they can do the thing - other logic has to be checked in the policy (that they have a relationship to the thing, that the thing has the right state etc).

Perhaps creating individual classes for each of those checks? Maybe could redirect the policy check to check individual classes instead of methods? How do other people organise complex permission checks?