diff --git a/database/factories/PermissionFactory.php b/database/factories/PermissionFactory.php
index d2cec7f..365446d 100644
--- a/database/factories/PermissionFactory.php
+++ b/database/factories/PermissionFactory.php
@@ -17,7 +17,9 @@ class PermissionFactory extends Factory
     public function definition(): array
     {
         return [
-            //
+            'name' => $this->faker->unique()->slug,
+            'name_fa' => $this->faker->word,
+            'guard_name' => 'web',
         ];
     }
 }
diff --git a/routes/web.php b/routes/web.php
index 5714891..5da8281 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -60,6 +60,7 @@ Route::prefix('server')->group(function () {
 
     Route::middleware('auth')
         ->prefix('permissions')
+        ->name('permissions.')
         ->controller(PermissionManagementController::class)
         ->group(function () {
             Route::get('/', 'index')->name('index');
diff --git a/tests/Feature/Permission/DeleteTest.php b/tests/Feature/Permission/DeleteTest.php
new file mode 100644
index 0000000..d0b1d4c
--- /dev/null
+++ b/tests/Feature/Permission/DeleteTest.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class DeleteTest extends TestCase
+{
+   use RefreshDatabase, WithFaker;
+
+    public function test_authenticated_user_can_delete_permission(): void
+    {
+        $user = User::factory()->create();
+        $permission = Permission::factory()->create();
+
+        $response = $this->actingAs($user)->deleteJson(route('permissions.destroy', $permission));
+
+        $response->assertOk()
+            ->assertJson([
+                'message' => __('messages.successful'),
+            ]);
+
+        $this->assertDatabaseMissing('permissions', [
+            'id' => $permission->id,
+        ]);
+    }
+
+    public function test_guest_cannot_delete_permission(): void
+    {
+        $permission = Permission::factory()->create();
+
+        $response = $this->deleteJson(route('permissions.destroy', $permission));
+
+        $response->assertUnauthorized();
+    }
+
+}
diff --git a/tests/Feature/Permission/IndexTest.php b/tests/Feature/Permission/IndexTest.php
new file mode 100644
index 0000000..be3ebd4
--- /dev/null
+++ b/tests/Feature/Permission/IndexTest.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class IndexTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_unauthenticated_user_cannot_access_permission_index(): void
+    {
+        $response = $this->getJson(route('permissions.list'));
+
+        $response->assertStatus(401);
+    }
+
+    public function test_all_permissions_returned_successfully(): void
+    {
+        $user = User::factory()
+            ->has(Permission::factory()->state([
+                'name' => 'permissions',
+                'name_fa' => 'مدیریت دسترسی',
+                'guard_name' => 'web',
+            ]))
+            ->create();
+
+        $response = $this->actingAs($user)->getJson(route('permissions.index'));
+
+        $response->assertOk();
+
+        $response->assertJsonStructure([
+            'data' => [
+                '*' => [
+                    'id',
+                    'name',
+                    'name_fa',
+                    'guard_name',
+                    'created_at',
+                    'updated_at',
+                ],
+            ]
+        ]);
+
+    }
+}
diff --git a/tests/Feature/Permission/ListTest.php b/tests/Feature/Permission/ListTest.php
new file mode 100644
index 0000000..036ee3d
--- /dev/null
+++ b/tests/Feature/Permission/ListTest.php
@@ -0,0 +1,57 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Illuminate\Testing\Fluent\AssertableJson;
+use Tests\TestCase;
+
+class ListTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_unauthenticated_user_cannot_access_permission_list(): void
+    {
+        $response = $this->getJson(route('permissions.list'));
+
+        $response->assertStatus(401);
+    }
+
+
+    public function test_guest_user_cannot_access_list(): void
+    {
+        $response = $this->getJson(route('permissions.list'));
+
+        $response->assertUnauthorized();
+    }
+
+    public function test_permissions_list_returns_correct_structure(): void
+    {
+        $user = User::factory()
+            ->has(Permission::factory()->state([
+                'name' => 'manage-permissions',
+                'name_fa' => 'مدیریت دسترسی‌ها',
+                'guard_name' => 'web',
+            ]))
+            ->create();
+
+        Permission::factory()->count(3)->create();
+
+        $response = $this->actingAs($user)->getJson(route('permissions.list'));
+
+        $response->assertOk()
+            ->assertJsonStructure([
+                'data' => [
+                    '*' => [
+                        'id',
+                        'name',
+                        'name_fa',
+                    ]
+                ]
+            ]);
+    }
+
+}
diff --git a/tests/Feature/Permission/SHowTest.php b/tests/Feature/Permission/SHowTest.php
new file mode 100644
index 0000000..4d8997c
--- /dev/null
+++ b/tests/Feature/Permission/SHowTest.php
@@ -0,0 +1,53 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class SHowTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_guest_cannot_view_permission(): void
+    {
+        $permission = Permission::factory()->create();
+
+        $response = $this->getJson(route('permissions.show', $permission));
+
+        $response->assertUnauthorized();
+    }
+    public function test_permission_show_returns_correct_structure_and_data(): void
+    {
+        $user = User::factory()
+            ->has(Permission::factory()->state([
+                'name' => 'manage-permissions',
+                'name_fa' => 'مدیریت دسترسی‌ها',
+                'guard_name' => 'web',
+            ]))
+            ->create();
+
+        $permission = Permission::factory()->create([
+            'name' => 'edit-posts',
+            'name_fa' => 'ویرایش پست‌ها',
+            'guard_name' => 'web',
+        ]);
+
+        $response = $this->actingAs($user)->getJson(route('permissions.show', $permission));
+
+        $response->assertOk()
+            ->assertJson([
+                'data' => [
+                    'id' => $permission->id,
+                    'name' => 'edit-posts',
+                    'name_fa' => 'ویرایش پست‌ها',
+                    'guard_name' => 'web',
+                ]
+            ]);
+    }
+
+
+}
diff --git a/tests/Feature/Permission/StoreTest.php b/tests/Feature/Permission/StoreTest.php
new file mode 100644
index 0000000..2517eaa
--- /dev/null
+++ b/tests/Feature/Permission/StoreTest.php
@@ -0,0 +1,117 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class StoreTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_user_must_be_authenticated(): void
+    {
+        $response = $this->postJson(route('permissions.store'), []);
+        $response->assertUnauthorized();
+    }
+
+    public function test_name_and_name_fa_fields_are_required(): void
+    {
+        $user = User::factory()->create();
+
+
+        $response =  $this->actingAs($user)->postJson(route('permissions.store'));
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.required', ['attribute' => 'نام']),
+                'name_fa' => __('validation.required', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+    public function test_name_and_name_fa_fields_must_be_unique(): void
+    {
+        $user = User::factory()->create();
+
+        $duplicateName = $this->faker->unique()->slug;
+        $duplicateNameFa = $this->faker->unique()->word;
+
+        Permission::create([
+            'name' => $duplicateName,
+            'name_fa' => $duplicateNameFa,
+            'guard_name' => 'web',
+        ]);
+
+        $response = $this->actingAs($user)->postJson(route('permissions.store'), [
+            'name' => $duplicateName, // حالا واقعا تکراری هستند
+            'name_fa' => $duplicateNameFa,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.unique', ['attribute' => 'نام']),
+                'name_fa' => __('validation.unique', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+
+    public function test_name_and_name_fa_must_be_strings(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('permissions.store'), [
+            'name' =>$this->faker->randomDigit(),
+            'name_fa' => $this->faker->randomDigit(),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.string', ['attribute' => 'نام']),
+                'name_fa' => __('validation.string', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+    public function test_name_and_name_fa_must_not_exceed_max_length(): void
+    {
+        $user = User::factory()->create();
+
+        $longString = $this->faker->regexify('[a-zA-Z0-9]{256}');
+
+        $response = $this->actingAs($user)->postJson(route('permissions.store'), [
+            'name' => $longString,
+            'name_fa' => $longString,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.max.string', ['attribute' => 'نام', 'max' => 255]),
+                'name_fa' => __('validation.max.string', ['attribute' => 'نام فارسی', 'max' => 255]),
+            ]);
+    }
+
+    public function test_valid_permission_is_stored_successfully(): void
+    {
+        $user = User::factory()->create();
+
+        $payload = [
+            'name' => $this->faker->unique()->slug,
+            'name_fa' => $this->faker->unique()->words(2, true),
+        ];
+
+        $response = $this->actingAs($user)->postJson(route('permissions.store'), $payload);
+
+        $response->assertOk()
+            ->assertJson([
+                'message' => __('messages.successful'),
+            ]);
+
+        $this->assertDatabaseHas('permissions', [
+            'name' => $payload['name'],
+            'name_fa' => $payload['name_fa'],
+        ]);
+    }
+
+
+}
diff --git a/tests/Feature/Permission/UpdateTest.php b/tests/Feature/Permission/UpdateTest.php
new file mode 100644
index 0000000..855832e
--- /dev/null
+++ b/tests/Feature/Permission/UpdateTest.php
@@ -0,0 +1,114 @@
+<?php
+
+namespace Tests\Feature\Permission;
+
+use App\Models\Permission;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Foundation\Testing\WithFaker;
+use Tests\TestCase;
+
+class UpdateTest extends TestCase
+{
+    use RefreshDatabase, WithFaker;
+
+    public function test_user_must_be_authenticated(): void
+    {
+        $response = $this->postJson(route('permissions.store'), []);
+        $response->assertUnauthorized();
+    }
+
+
+    public function test_name_and_name_fa_fields_are_required(): void
+    {
+        $user = User::factory()->create();
+        $permission = Permission::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('permissions.update', $permission));
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.required', ['attribute' => 'نام']),
+                'name_fa' => __('validation.required', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+    public function test_name_and_name_fa_fields_must_be_strings(): void
+    {
+        $user = User::factory()->create();
+        $permission = Permission::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('permissions.update', $permission), [
+            'name' =>$this->faker->randomDigit(),
+            'name_fa' => $this->faker->randomDigit(),
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.string', ['attribute' => 'نام']),
+                'name_fa' => __('validation.string', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+    public function test_name_and_name_fa_fields_must_be_unique_except_current(): void
+    {
+        $user = User::factory()->create();
+
+        $permission1 = Permission::factory()->create();
+        $permission2 = Permission::factory()->create();
+
+        $response = $this->actingAs($user)->postJson(route('permissions.update', $permission1), [
+            'name' => $permission2->name,
+            'name_fa' => $permission2->name_fa,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.unique', ['attribute' => 'نام']),
+                'name_fa' => __('validation.unique', ['attribute' => 'نام فارسی']),
+            ]);
+    }
+
+    public function test_name_and_name_fa_must_not_exceed_max_length(): void
+    {
+        $user = User::factory()->create();
+        $permission = Permission::factory()->create();
+
+        $longString = $this->faker->regexify('[a-zA-Z0-9]{256}');
+
+        $response = $this->actingAs($user)->postJson(route('permissions.update', $permission), [
+            'name' => $longString,
+            'name_fa' => $longString,
+        ]);
+
+        $response->assertUnprocessable()
+            ->assertInvalid([
+                'name' => __('validation.max.string', ['attribute' => 'نام', 'max' => 255]),
+                'name_fa' => __('validation.max.string', ['attribute' => 'نام فارسی', 'max' => 255]),
+            ]);
+    }
+
+    public function test_valid_permission_is_updated_successfully(): void
+    {
+        $user = User::factory()->create();
+        $permission = Permission::factory()->create();
+
+        $payload = [
+            'name' => $this->faker->unique()->slug,
+            'name_fa' => $this->faker->unique()->words(2, true),
+        ];
+
+        $response = $this->actingAs($user)->postJson(route('permissions.update', $permission), $payload);
+
+        $response->assertOk()
+            ->assertJson([
+                'message' => __('messages.successful'),
+            ]);
+
+        $this->assertDatabaseHas('permissions', [
+            'id' => $permission->id,
+            'name' => $payload['name'],
+            'name_fa' => $payload['name_fa'],
+        ]);
+    }
+}