diff --git a/app/Http/Middleware/EnsureActiveLicense.php b/app/Http/Middleware/EnsureActiveLicense.php
new file mode 100644
index 0000000..2e98f1b
--- /dev/null
+++ b/app/Http/Middleware/EnsureActiveLicense.php
@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class EnsureActiveLicense
+{
+    public function handle(Request $request, Closure $next): mixed
+    {
+        // Full implementation in Phase 4 (requires License model)
+        return $next($request);
+    }
+}
diff --git a/app/Policies/LicensePolicy.php b/app/Policies/LicensePolicy.php
new file mode 100644
index 0000000..d37f847
--- /dev/null
+++ b/app/Policies/LicensePolicy.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\License;
+use App\Models\User;
+
+class LicensePolicy
+{
+    public function viewAny(User $actor): bool
+    {
+        return $actor->hasRole('platform-admin') || $actor->hasRole('school-admin');
+    }
+
+    public function view(User $actor, License $license): bool
+    {
+        if ($actor->hasRole('platform-admin')) return true;
+        return $actor->tenant_id === $license->tenant_id;
+    }
+
+    public function create(User $actor): bool
+    {
+        return $actor->hasRole('platform-admin');
+    }
+
+    public function update(User $actor, License $license): bool
+    {
+        return $actor->hasRole('platform-admin');
+    }
+}
diff --git a/app/Policies/ParentChildPolicy.php b/app/Policies/ParentChildPolicy.php
new file mode 100644
index 0000000..a285e5d
--- /dev/null
+++ b/app/Policies/ParentChildPolicy.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+
+class ParentChildPolicy
+{
+    public function attach(User $actor, User $parent, User $child): bool
+    {
+        if ($actor->hasRole('platform-admin')) return true;
+        return $actor->hasRole('parent') && $actor->id === $parent->id;
+    }
+
+    public function detach(User $actor, User $parent, User $child): bool
+    {
+        if ($actor->hasRole('platform-admin')) return true;
+        return $actor->hasRole('parent') && $actor->id === $parent->id;
+    }
+}
diff --git a/app/Policies/TenantPolicy.php b/app/Policies/TenantPolicy.php
new file mode 100644
index 0000000..ab7488e
--- /dev/null
+++ b/app/Policies/TenantPolicy.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Tenant;
+use App\Models\User;
+
+class TenantPolicy
+{
+    public function viewAny(User $actor): bool
+    {
+        return $actor->hasRole('platform-admin');
+    }
+
+    public function view(User $actor, Tenant $tenant): bool
+    {
+        if ($actor->hasRole('platform-admin')) return true;
+        return $actor->tenant_id === $tenant->id;
+    }
+
+    public function create(User $actor): bool
+    {
+        return $actor->hasRole('platform-admin');
+    }
+
+    public function update(User $actor, Tenant $tenant): bool
+    {
+        return $actor->hasRole('platform-admin');
+    }
+}
diff --git a/app/Policies/UserPolicy.php b/app/Policies/UserPolicy.php
new file mode 100644
index 0000000..627ef04
--- /dev/null
+++ b/app/Policies/UserPolicy.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+
+class UserPolicy
+{
+    public function viewAny(User $actor): bool
+    {
+        return $actor->hasRole('platform-admin')
+            || $actor->hasRole('school-admin')
+            || $actor->hasRole('teacher');
+    }
+
+    public function view(User $actor, User $target): bool
+    {
+        if ($actor->hasRole('platform-admin')) return true;
+        return $actor->tenant_id === $target->tenant_id;
+    }
+
+    public function create(User $actor): bool
+    {
+        return $actor->hasRole('platform-admin') || $actor->hasRole('school-admin');
+    }
+
+    public function update(User $actor, User $target): bool
+    {
+        if ($actor->hasRole('platform-admin')) return true;
+        return $actor->hasRole('school-admin') && $actor->tenant_id === $target->tenant_id;
+    }
+
+    public function delete(User $actor, User $target): bool
+    {
+        if ($actor->hasRole('platform-admin')) return true;
+        return $actor->hasRole('school-admin') && $actor->tenant_id === $target->tenant_id;
+    }
+}
diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php
index 452e6b6..0447918 100644
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -2,6 +2,14 @@
 
 namespace App\Providers;
 
+use App\Models\License;
+use App\Models\Tenant;
+use App\Models\User;
+use App\Policies\LicensePolicy;
+use App\Policies\TenantPolicy;
+use App\Policies\UserPolicy;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Facades\URL;
 use Illuminate\Support\ServiceProvider;
 
 class AppServiceProvider extends ServiceProvider
@@ -19,6 +27,12 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
-        //
+        if (app()->environment() !== 'testing') {
+            URL::forceScheme('https');
+        }
+
+        Gate::policy(User::class, UserPolicy::class);
+        Gate::policy(License::class, LicensePolicy::class);
+        Gate::policy(Tenant::class, TenantPolicy::class);
     }
 }