diff --git a/resources/js/components/roles/PermissionTree.vue b/resources/js/components/roles/PermissionTree.vue
index a25fbe8b014..2bec1e60434 100644
--- a/resources/js/components/roles/PermissionTree.vue
+++ b/resources/js/components/roles/PermissionTree.vue
@@ -1,6 +1,6 @@
 <template>
     <div :style="`padding-inline-start: ${12 * depth - 12}px`">
-        <template v-for="permission in permissions" :key="permission.value">
+        <template v-for="permission in visiblePermissions" :key="permission.value">
             <ui-checkbox
                 :class="[
                     permission.description
@@ -18,16 +18,23 @@
                 v-if="permission.children.length"
                 :depth="depth + 1"
                 :initial-permissions="permission.children"
+                :checked-permissions="checkedPermissions"
             />
         </template>
     </div>
 </template>
 
 <script>
+import { visible } from '@/components/roles/permissions.js';
+
 export default {
     props: {
         initialPermissions: Array,
         depth: Number,
+        checkedPermissions: {
+            type: Array,
+            default: () => [],
+        },
     },
 
     data() {
@@ -36,6 +43,12 @@ export default {
         };
     },
 
+    computed: {
+        visiblePermissions() {
+            return visible(this.permissions, this.checkedPermissions);
+        },
+    },
+
     watch: {
         initialPermissions: {
             handler(newPermissions) {
diff --git a/resources/js/components/roles/PublishForm.vue b/resources/js/components/roles/PublishForm.vue
index 6b7098ed7dc..b85995bc14a 100644
--- a/resources/js/components/roles/PublishForm.vue
+++ b/resources/js/components/roles/PublishForm.vue
@@ -67,7 +67,11 @@
                     </Button>
                 </template>
                 <Card>
-                    <PermissionTree :depth="1" :initial-permissions="group.permissions" />
+                    <PermissionTree
+                        :depth="1"
+                        :initial-permissions="group.permissions"
+                        :checked-permissions="checkedPermissions"
+                    />
                 </Card>
             </Panel>
         </div>
@@ -78,6 +82,7 @@
 import { Header, Button, Panel, PanelHeader, Heading, Card, Switch, Field, Input, CommandPaletteItem } from '@/components/ui';
 import { requireElevatedSession } from '@/components/elevated-sessions';
 import PermissionTree from '@/components/roles/PermissionTree.vue';
+import { allVisibleChecked, checkVisible, uncheckAll, visible } from '@/components/roles/permissions.js';
 import { router } from '@inertiajs/vue3';
 
 const checked = function (permissions) {
@@ -159,46 +164,39 @@ export default {
 
     methods: {
         areAllChecked(group) {
-            const checkAll = (permissions) => {
-                return permissions.every(permission => {
-                    const childrenChecked = permission.children && permission.children.length
-                        ? checkAll(permission.children)
-                        : true;
-                    return permission.checked && childrenChecked;
-                });
-            };
-            return checkAll(group.permissions);
+            const checkedPermissions = this.checkedPermissions;
+            const shown = visible(group.permissions, checkedPermissions);
+
+            return shown.length > 0 && allVisibleChecked(shown, checkedPermissions);
         },
 
         areAllCheckedInAllGroups() {
             return this.permissions.every(group => this.areAllChecked(group));
         },
 
+        // Checking only affects what the user can see, but unchecking clears the group
+        // outright. Unchecking a broader permission reveals the ones it was hiding, so
+        // leaving those checked would need a second click to empty the group.
         toggleAllInGroup(group) {
-            const allChecked = this.areAllChecked(group);
-            const toggle = (permissions, checked) => {
-                permissions.forEach(permission => {
-                    permission.checked = checked;
-                    if (permission.children && permission.children.length) {
-                        toggle(permission.children, checked);
-                    }
-                });
-            };
-            toggle(group.permissions, !allChecked);
+            const checkedPermissions = this.checkedPermissions;
+
+            if (this.areAllChecked(group)) {
+                uncheckAll(group.permissions);
+            } else {
+                checkVisible(group.permissions, checkedPermissions);
+            }
         },
 
         toggleAllInAllGroups() {
+            const checkedPermissions = this.checkedPermissions;
             const allChecked = this.areAllCheckedInAllGroups();
-            this.permissions.forEach(group => {
-                const toggle = (permissions, checked) => {
-                    permissions.forEach(permission => {
-                        permission.checked = checked;
-                        if (permission.children && permission.children.length) {
-                            toggle(permission.children, checked);
-                        }
-                    });
-                };
-                toggle(group.permissions, !allChecked);
+
+            this.permissions.forEach((group) => {
+                if (allChecked) {
+                    uncheckAll(group.permissions);
+                } else {
+                    checkVisible(group.permissions, checkedPermissions);
+                }
             });
         },
 
diff --git a/resources/js/components/roles/permissions.js b/resources/js/components/roles/permissions.js
new file mode 100644
index 00000000000..a5b6e4bd47a
--- /dev/null
+++ b/resources/js/components/roles/permissions.js
@@ -0,0 +1,29 @@
+export function isVisible(permission, checkedPermissions) {
+    return !permission.hidden_by.some((value) => checkedPermissions.includes(value));
+}
+
+export function visible(permissions, checkedPermissions) {
+    return permissions.filter((permission) => isVisible(permission, checkedPermissions));
+}
+
+export function allVisibleChecked(permissions, checkedPermissions) {
+    return visible(permissions, checkedPermissions).every(
+        (permission) => permission.checked && allVisibleChecked(permission.children, checkedPermissions),
+    );
+}
+
+// The checked permissions are snapshotted by the caller. Visibility must not shift
+// as we check things, otherwise checking a permission would hide the ones after it.
+export function checkVisible(permissions, checkedPermissions) {
+    visible(permissions, checkedPermissions).forEach((permission) => {
+        permission.checked = true;
+        checkVisible(permission.children, checkedPermissions);
+    });
+}
+
+export function uncheckAll(permissions) {
+    permissions.forEach((permission) => {
+        permission.checked = false;
+        uncheckAll(permission.children);
+    });
+}
diff --git a/resources/js/tests/components/roles/PermissionTree.test.js b/resources/js/tests/components/roles/PermissionTree.test.js
new file mode 100644
index 00000000000..3305fd38a29
--- /dev/null
+++ b/resources/js/tests/components/roles/PermissionTree.test.js
@@ -0,0 +1,141 @@
+import { mount } from '@vue/test-utils';
+import { expect, test } from 'vitest';
+import PermissionTree from '@/components/roles/PermissionTree.vue';
+
+const permission = (value, overrides = {}) => ({
+    value,
+    label: value,
+    description: null,
+    checked: false,
+    hidden_by: [],
+    children: [],
+    ...overrides,
+});
+
+const mountTree = (permissions, checkedPermissions = []) =>
+    mount(PermissionTree, {
+        props: { depth: 1, initialPermissions: permissions, checkedPermissions },
+        global: {
+            stubs: {
+                'ui-checkbox': {
+                    props: ['value'],
+                    template: '<div class="permission">{{ value }}</div>',
+                },
+            },
+        },
+    });
+
+const renderedPermissions = (wrapper) => wrapper.findAll('.permission').map((el) => el.text());
+
+test('it shows a permission when the permission hiding it is unchecked', () => {
+    const wrapper = mountTree([
+        permission('configure asset containers'),
+        permission('view images assets', { hidden_by: ['configure asset containers'] }),
+    ]);
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers', 'view images assets']);
+});
+
+test('it hides a permission when the permission hiding it is checked', () => {
+    const wrapper = mountTree(
+        [
+            permission('configure asset containers', { checked: true }),
+            permission('view images assets', { hidden_by: ['configure asset containers'] }),
+        ],
+        ['configure asset containers'],
+    );
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers']);
+});
+
+test('it hides the children of a hidden permission', () => {
+    const wrapper = mountTree(
+        [
+            permission('configure asset containers', { checked: true }),
+            permission('view images assets', {
+                hidden_by: ['configure asset containers'],
+                children: [permission('delete images assets')],
+            }),
+        ],
+        ['configure asset containers'],
+    );
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers']);
+});
+
+test('it only hides permissions hidden by a checked permission', () => {
+    const wrapper = mountTree(
+        [
+            permission('configure asset containers', { checked: true }),
+            permission('view images assets', { hidden_by: ['configure asset containers'] }),
+            permission('view blog entries', { hidden_by: ['configure collections'] }),
+        ],
+        ['configure asset containers'],
+    );
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers', 'view blog entries']);
+});
+
+test('it hides a nested permission when the permission hiding it is checked', () => {
+    const wrapper = mountTree(
+        [
+            permission('configure collections', { checked: true }),
+            permission('view blog entries', {
+                children: [permission('publish blog entries', { hidden_by: ['configure collections'] })],
+            }),
+        ],
+        ['configure collections'],
+    );
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure collections', 'view blog entries']);
+});
+
+test('it shows everything when no checked permissions are given', () => {
+    const wrapper = mount(PermissionTree, {
+        props: {
+            depth: 1,
+            initialPermissions: [permission('view images assets', { hidden_by: ['configure asset containers'] })],
+        },
+        global: {
+            stubs: { 'ui-checkbox': { props: ['value'], template: '<div class="permission">{{ value }}</div>' } },
+        },
+    });
+
+    expect(renderedPermissions(wrapper)).toEqual(['view images assets']);
+});
+
+test('unhiding a permission brings back its checked state', async () => {
+    const permissions = [
+        permission('configure asset containers', { checked: true }),
+        permission('view images assets', { checked: true, hidden_by: ['configure asset containers'] }),
+    ];
+
+    const wrapper = mountTree(permissions, ['configure asset containers']);
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers']);
+
+    await wrapper.setProps({ checkedPermissions: [] });
+
+    expect(renderedPermissions(wrapper)).toEqual(['configure asset containers', 'view images assets']);
+    expect(permissions[1].checked).toBe(true);
+});
+
+test('it hides a permission when any of the permissions hiding it are checked', () => {
+    const permissions = () => [
+        permission('configure forms'),
+        permission('edit forms'),
+        permission('edit contact form', { hidden_by: ['configure forms', 'edit forms'] }),
+    ];
+
+    expect(renderedPermissions(mountTree(permissions(), ['configure forms']))).toEqual([
+        'configure forms',
+        'edit forms',
+    ]);
+
+    expect(renderedPermissions(mountTree(permissions(), ['edit forms']))).toEqual(['configure forms', 'edit forms']);
+
+    expect(renderedPermissions(mountTree(permissions(), []))).toEqual([
+        'configure forms',
+        'edit forms',
+        'edit contact form',
+    ]);
+});
diff --git a/resources/js/tests/components/roles/PublishForm.test.js b/resources/js/tests/components/roles/PublishForm.test.js
new file mode 100644
index 00000000000..dc3f8c27040
--- /dev/null
+++ b/resources/js/tests/components/roles/PublishForm.test.js
@@ -0,0 +1,170 @@
+import { shallowMount } from '@vue/test-utils';
+import { describe, expect, test } from 'vitest';
+import PublishForm from '@/components/roles/PublishForm.vue';
+
+const permission = (value, overrides = {}) => ({
+    value,
+    label: value,
+    description: null,
+    checked: false,
+    hidden_by: [],
+    children: [],
+    ...overrides,
+});
+
+const group = (handle, permissions) => ({ handle, label: handle, permissions });
+
+const mountForm = (groups) =>
+    shallowMount(PublishForm, {
+        props: {
+            initialTitle: 'Test',
+            initialHandle: 'test',
+            initialPermissions: groups,
+            initialSuper: false,
+            canAssignSuper: false,
+            action: '/roles',
+            method: 'post',
+            indexUrl: '/roles',
+        },
+        global: {
+            mocks: { $keys: { bindGlobal: () => {} } },
+        },
+    });
+
+// The collections group, as core registers it: a configure permission that hides
+// the per-collection permission sitting next to it.
+const collectionsGroup = (overrides = {}) =>
+    group('collections', [
+        permission('configure collections', { checked: overrides.configure ?? false }),
+        permission('view blog entries', {
+            checked: overrides.view ?? false,
+            hidden_by: ['configure collections'],
+            children: [permission('delete blog entries', { checked: overrides.delete ?? false })],
+        }),
+    ]);
+
+describe('areAllChecked', () => {
+    test('it ignores hidden permissions', () => {
+        const wrapper = mountForm([collectionsGroup({ configure: true })]);
+
+        // "view blog entries" is unchecked, but hidden, so the group reads as fully checked.
+        expect(wrapper.vm.areAllChecked(wrapper.vm.permissions[0])).toBe(true);
+    });
+
+    test('it is false while a visible permission is unchecked', () => {
+        const wrapper = mountForm([collectionsGroup()]);
+
+        expect(wrapper.vm.areAllChecked(wrapper.vm.permissions[0])).toBe(false);
+    });
+
+    test('it is false when a group has no visible permissions', () => {
+        const wrapper = mountForm([
+            group('cp', [permission('configure collections', { checked: true })]),
+            group('collections', [permission('view blog entries', { hidden_by: ['configure collections'] })]),
+        ]);
+
+        // Nothing in the group renders, so the button must not offer to uncheck anything.
+        expect(wrapper.vm.areAllChecked(wrapper.vm.permissions[1])).toBe(false);
+    });
+});
+
+describe('toggleAllInGroup', () => {
+    test('checking only checks what is visible', () => {
+        // The hider is checked, so "view thing" is hidden. The unchecked sibling is what
+        // leaves the group with something for Check All to do.
+        const wrapper = mountForm([
+            group('test', [
+                permission('configure things', { checked: true }),
+                permission('view thing', {
+                    hidden_by: ['configure things'],
+                    children: [permission('delete thing')],
+                }),
+                permission('view other thing'),
+            ]),
+        ]);
+        const test = wrapper.vm.permissions[0];
+
+        expect(wrapper.vm.areAllChecked(test)).toBe(false);
+
+        wrapper.vm.toggleAllInGroup(test);
+
+        expect(wrapper.vm.checkedPermissions).toEqual(['configure things', 'view other thing']);
+    });
+
+    test('checking an empty group checks everything, since nothing is hidden yet', () => {
+        const wrapper = mountForm([collectionsGroup()]);
+        const collections = wrapper.vm.permissions[0];
+
+        wrapper.vm.toggleAllInGroup(collections);
+
+        expect(collections.permissions[0].checked).toBe(true);
+        expect(collections.permissions[1].checked).toBe(true);
+        expect(collections.permissions[1].children[0].checked).toBe(true);
+    });
+
+    test('unchecking clears the whole group, including hidden permissions', () => {
+        const wrapper = mountForm([collectionsGroup({ configure: true, view: true, delete: true })]);
+        const collections = wrapper.vm.permissions[0];
+
+        expect(wrapper.vm.areAllChecked(collections)).toBe(true);
+
+        wrapper.vm.toggleAllInGroup(collections);
+
+        expect(collections.permissions[0].checked).toBe(false);
+        expect(collections.permissions[1].checked).toBe(false);
+        expect(collections.permissions[1].children[0].checked).toBe(false);
+    });
+
+    test('one click always empties a fully checked group', () => {
+        // Check All, then Uncheck All. The group must end up empty, not half revealed.
+        const wrapper = mountForm([collectionsGroup()]);
+        const collections = wrapper.vm.permissions[0];
+
+        wrapper.vm.toggleAllInGroup(collections);
+        expect(wrapper.vm.areAllChecked(collections)).toBe(true);
+
+        wrapper.vm.toggleAllInGroup(collections);
+
+        expect(wrapper.vm.checkedPermissions).toEqual([]);
+        expect(wrapper.vm.areAllChecked(collections)).toBe(false);
+    });
+});
+
+describe('toggleAllInAllGroups', () => {
+    test('checking only checks what is visible in every group', () => {
+        const wrapper = mountForm([
+            collectionsGroup({ configure: true }),
+            group('users', [permission('view users')]),
+        ]);
+
+        wrapper.vm.toggleAllInAllGroups();
+
+        expect(wrapper.vm.checkedPermissions).toEqual(['configure collections', 'view users']);
+    });
+
+    test('checking a permission does not hide the ones checked after it', () => {
+        // Visibility is snapshotted before anything is checked. Reading it as we walk would
+        // let "configure things" hide "view thing" before we reach it.
+        const wrapper = mountForm([
+            group('one', [permission('configure things')]),
+            group('two', [permission('view thing', { hidden_by: ['configure things'] })]),
+        ]);
+
+        wrapper.vm.toggleAllInAllGroups();
+
+        expect(wrapper.vm.checkedPermissions).toEqual(['configure things', 'view thing']);
+    });
+
+    test('unchecking clears every group, including hidden permissions', () => {
+        const wrapper = mountForm([
+            collectionsGroup({ configure: true, view: true, delete: true }),
+            group('users', [permission('view users', { checked: true })]),
+        ]);
+
+        expect(wrapper.vm.areAllCheckedInAllGroups()).toBe(true);
+
+        wrapper.vm.toggleAllInAllGroups();
+
+        expect(wrapper.vm.checkedPermissions).toEqual([]);
+    });
+});
diff --git a/resources/js/tests/components/roles/permissions.test.js b/resources/js/tests/components/roles/permissions.test.js
new file mode 100644
index 00000000000..301d25ee450
--- /dev/null
+++ b/resources/js/tests/components/roles/permissions.test.js
@@ -0,0 +1,139 @@
+import { describe, expect, test } from 'vitest';
+import { allVisibleChecked, checkVisible, isVisible, uncheckAll, visible } from '@/components/roles/permissions.js';
+
+const permission = (value, overrides = {}) => ({
+    value,
+    checked: false,
+    hidden_by: [],
+    children: [],
+    ...overrides,
+});
+
+const values = (permissions) => permissions.map((permission) => permission.value);
+
+const flatten = (permissions) => permissions.flatMap((p) => [p, ...flatten(p.children)]);
+
+const checkedValues = (permissions) =>
+    flatten(permissions)
+        .filter((permission) => permission.checked)
+        .map((permission) => permission.value);
+
+describe('isVisible', () => {
+    test('a permission with no hiders is always visible', () => {
+        expect(isVisible(permission('one'), [])).toBe(true);
+        expect(isVisible(permission('one'), ['two'])).toBe(true);
+    });
+
+    test('a permission is hidden when any of its hiders are checked', () => {
+        const one = permission('one', { hidden_by: ['two', 'three'] });
+
+        expect(isVisible(one, [])).toBe(true);
+        expect(isVisible(one, ['four'])).toBe(true);
+        expect(isVisible(one, ['two'])).toBe(false);
+        expect(isVisible(one, ['three'])).toBe(false);
+        expect(isVisible(one, ['two', 'three'])).toBe(false);
+    });
+});
+
+describe('visible', () => {
+    test('it filters out hidden permissions', () => {
+        const permissions = [
+            permission('configure collections'),
+            permission('view blog entries', { hidden_by: ['configure collections'] }),
+            permission('view users'),
+        ];
+
+        expect(values(visible(permissions, []))).toEqual([
+            'configure collections',
+            'view blog entries',
+            'view users',
+        ]);
+
+        expect(values(visible(permissions, ['configure collections']))).toEqual([
+            'configure collections',
+            'view users',
+        ]);
+    });
+});
+
+describe('allVisibleChecked', () => {
+    test('it is true when every visible permission is checked', () => {
+        const permissions = [
+            permission('configure collections', { checked: true }),
+            permission('view blog entries', { hidden_by: ['configure collections'] }),
+        ];
+
+        expect(allVisibleChecked(permissions, ['configure collections'])).toBe(true);
+        expect(allVisibleChecked(permissions, [])).toBe(false);
+    });
+
+    test('it recurses into visible children only', () => {
+        const permissions = [
+            permission('configure collections', { checked: true }),
+            permission('view blog entries', {
+                checked: true,
+                children: [
+                    permission('publish blog entries', { hidden_by: ['configure collections'] }),
+                    permission('delete blog entries', { checked: true }),
+                ],
+            }),
+        ];
+
+        expect(allVisibleChecked(permissions, ['configure collections'])).toBe(true);
+        expect(allVisibleChecked(permissions, [])).toBe(false);
+    });
+
+    test('an unchecked visible permission makes it false', () => {
+        const permissions = [permission('one', { checked: true }), permission('two')];
+
+        expect(allVisibleChecked(permissions, [])).toBe(false);
+    });
+
+    test('an empty set is vacuously true, so callers must guard the top level', () => {
+        expect(allVisibleChecked([], [])).toBe(true);
+    });
+});
+
+describe('checkVisible', () => {
+    test('it checks visible permissions and their visible children', () => {
+        const permissions = [
+            permission('configure collections'),
+            permission('view blog entries', {
+                hidden_by: ['configure collections'],
+                children: [permission('delete blog entries')],
+            }),
+        ];
+
+        checkVisible(permissions, ['configure collections']);
+
+        expect(checkedValues(permissions)).toEqual(['configure collections']);
+    });
+
+    test('it does not let the permissions it checks hide the ones that follow', () => {
+        const permissions = [
+            permission('configure collections'),
+            permission('view blog entries', { hidden_by: ['configure collections'] }),
+        ];
+
+        checkVisible(permissions, []);
+
+        expect(checkedValues(permissions)).toEqual(['configure collections', 'view blog entries']);
+    });
+});
+
+describe('uncheckAll', () => {
+    test('it unchecks everything, including hidden permissions', () => {
+        const permissions = [
+            permission('configure collections', { checked: true }),
+            permission('view blog entries', {
+                checked: true,
+                hidden_by: ['configure collections'],
+                children: [permission('delete blog entries', { checked: true })],
+            }),
+        ];
+
+        uncheckAll(permissions);
+
+        expect(checkedValues(permissions)).toEqual([]);
+    });
+});
diff --git a/src/Auth/CorePermissions.php b/src/Auth/CorePermissions.php
index d0d3eeb125d..1d371fa080c 100644
--- a/src/Auth/CorePermissions.php
+++ b/src/Auth/CorePermissions.php
@@ -95,7 +95,7 @@ protected function registerCollections()
         $this->register('configure collections');
 
         $this->register('view {collection} entries', function ($permission) {
-            $this->permission($permission)->children([
+            $this->permission($permission)->hiddenBy('configure collections')->children([
                 $this->permission('edit {collection} entries')->children([
                     $this->permission('create {collection} entries'),
                     $this->permission('delete {collection} entries'),
@@ -119,7 +119,7 @@ protected function registerNavigation()
         $this->register('configure navs');
 
         $this->register('view {nav} nav', function ($permission) {
-            $this->permission($permission)->children([
+            $this->permission($permission)->hiddenBy('configure navs')->children([
                 $this->permission('edit {nav} nav'),
             ])->replacements('nav', function () {
                 return Nav::all()->map(function ($nav) {
@@ -134,7 +134,7 @@ protected function registerGlobals()
         $this->register('configure globals');
 
         $this->register('edit {global} globals', function ($permission) {
-            $permission->replacements('global', function () {
+            $permission->hiddenBy('configure globals')->replacements('global', function () {
                 return GlobalSet::all()->map(function ($global) {
                     return ['value' => $global->handle(), 'label' => __($global->title())];
                 });
@@ -147,7 +147,7 @@ protected function registerTaxonomies()
         $this->register('configure taxonomies');
 
         $this->register('view {taxonomy} terms', function ($permission) {
-            $this->permission($permission)->children([
+            $this->permission($permission)->hiddenBy('configure taxonomies')->children([
                 $this->permission('edit {taxonomy} terms')->children([
                     $this->permission('create {taxonomy} terms'),
                     $this->permission('delete {taxonomy} terms'),
@@ -165,7 +165,7 @@ protected function registerAssets()
         $this->register('configure asset containers');
 
         $this->register('view {container} assets', function ($permission) {
-            $this->permission($permission)->children([
+            $this->permission($permission)->hiddenBy('configure asset containers')->children([
                 $this->permission('upload {container} assets'),
                 $this->permission('edit {container} folders'),
                 $this->permission('edit {container} assets')->children([
@@ -210,7 +210,7 @@ protected function registerForms()
         $this->register('configure forms');
 
         $this->register('view {form} form submissions', function ($permission) {
-            $this->permission($permission)->children([
+            $this->permission($permission)->hiddenBy('configure forms')->children([
                 $this->permission('delete {form} form submissions'),
             ])->replacements('form', function () {
                 return Form::all()->map(function ($form) {
diff --git a/src/Auth/Permission.php b/src/Auth/Permission.php
index 0a91de22cab..bf42271e087 100644
--- a/src/Auth/Permission.php
+++ b/src/Auth/Permission.php
@@ -2,6 +2,7 @@
 
 namespace Statamic\Auth;
 
+use Statamic\Support\Arr;
 use Statamic\Support\Traits\FluentlyGetsAndSets;
 
 use function Statamic\trans as __;
@@ -19,6 +20,7 @@ class Permission
     protected $label;
     protected $description;
     protected $group;
+    protected $hiddenBy;
 
     /**
      * @return ($value is null ? string|string[] : static)
@@ -100,10 +102,12 @@ public function permissions()
             $replaced = (new self)
                 ->value($this->value)
                 ->label($this->label)
+                ->description($this->description())
                 ->placeholder($this->placeholder)
                 ->placeholderLabel($replacement['label'])
                 ->placeholderValue($replacement['value'])
-                ->group($this->group());
+                ->group($this->group())
+                ->hiddenBy($this->hiddenBy());
 
             if ($this->children()) {
                 $replaced->children($this->children()->all());
@@ -187,10 +191,12 @@ public function toTree()
                     $replaced = (new self)
                         ->value($child->originalValue())
                         ->label($child->originalLabel())
+                        ->description($child->description())
                         ->placeholder($permission->placeholder())
                         ->placeholderLabel($permission->placeholderLabel())
                         ->placeholderValue($permission->placeholderValue())
-                        ->group($permission->group());
+                        ->group($permission->group())
+                        ->hiddenBy($child->hiddenBy());
 
                     if ($children = $child->children()) {
                         $replaced->children($children->all());
@@ -205,6 +211,7 @@ public function toTree()
                 'label' => $permission->label(),
                 'description' => $permission->description(),
                 'group' => $permission->group(),
+                'hidden_by' => $permission->hiddenBy(),
                 'children' => $children->flatMap->toTree()->all(),
             ];
         })->all();
@@ -219,4 +226,13 @@ public function description()
     {
         return $this->fluentlyGetOrSet('description')->args(func_get_args());
     }
+
+    public function hiddenBy(string|array|null $permissions = null)
+    {
+        return $this
+            ->fluentlyGetOrSet('hiddenBy')
+            ->getter(fn ($permissions) => $permissions ?? [])
+            ->setter(fn ($permissions) => Arr::wrap($permissions))
+            ->args(func_get_args());
+    }
 }
diff --git a/src/Http/Controllers/CP/Collections/EntriesController.php b/src/Http/Controllers/CP/Collections/EntriesController.php
index a2392a4d0f9..acd8b573d60 100644
--- a/src/Http/Controllers/CP/Collections/EntriesController.php
+++ b/src/Http/Controllers/CP/Collections/EntriesController.php
@@ -347,7 +347,7 @@ public function create(Request $request, $collection, $site)
                 ];
             })->values()->all(),
             'revisionsEnabled' => $collection->revisionsEnabled(),
-            'canManagePublishState' => User::current()->can('publish '.$collection->handle().' entries'),
+            'canManagePublishState' => User::current()->can('publish', [EntryContract::class, $collection]),
             'previewTargets' => $collection->previewTargets()->all(),
             'autosaveInterval' => $collection->autosaveInterval(),
             'parent' => $collection->hasStructure() ? $request->parent : null,
diff --git a/tests/Feature/Entries/CreateEntryTest.php b/tests/Feature/Entries/CreateEntryTest.php
index ef8245ae536..ff3db43b69b 100644
--- a/tests/Feature/Entries/CreateEntryTest.php
+++ b/tests/Feature/Entries/CreateEntryTest.php
@@ -47,4 +47,46 @@ public function it_populates_the_form_from_query_string()
                 ->where('values.title', 'Foo Bar')
             );
     }
+
+    #[Test]
+    public function the_publish_state_cannot_be_managed_without_permission()
+    {
+        $this->setTestRoles(['test' => ['access cp', 'create test entries']]);
+        $user = tap(User::make()->assignRole('test'))->save();
+        Collection::make('test')->save();
+
+        $this
+            ->actingAs($user)
+            ->get(cp_route('collections.entries.create', ['test', 'en']))
+            ->assertOk()
+            ->assertInertia(fn ($page) => $page->where('canManagePublishState', false));
+    }
+
+    #[Test]
+    public function the_publish_state_can_be_managed_with_the_publish_permission()
+    {
+        $this->setTestRoles(['test' => ['access cp', 'create test entries', 'publish test entries']]);
+        $user = tap(User::make()->assignRole('test'))->save();
+        Collection::make('test')->save();
+
+        $this
+            ->actingAs($user)
+            ->get(cp_route('collections.entries.create', ['test', 'en']))
+            ->assertOk()
+            ->assertInertia(fn ($page) => $page->where('canManagePublishState', true));
+    }
+
+    #[Test]
+    public function the_publish_state_can_be_managed_when_able_to_configure_collections()
+    {
+        $this->setTestRoles(['test' => ['access cp', 'configure collections']]);
+        $user = tap(User::make()->assignRole('test'))->save();
+        Collection::make('test')->save();
+
+        $this
+            ->actingAs($user)
+            ->get(cp_route('collections.entries.create', ['test', 'en']))
+            ->assertOk()
+            ->assertInertia(fn ($page) => $page->where('canManagePublishState', true));
+    }
 }
diff --git a/tests/Permissions/CorePermissionsTest.php b/tests/Permissions/CorePermissionsTest.php
new file mode 100644
index 00000000000..46aaeeb342e
--- /dev/null
+++ b/tests/Permissions/CorePermissionsTest.php
@@ -0,0 +1,65 @@
+<?php
+
+namespace Tests\Permissions;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\Test;
+use Statamic\Facades\Collection;
+use Statamic\Facades\Permission;
+use Tests\PreventSavingStacheItemsToDisk;
+use Tests\TestCase;
+
+class CorePermissionsTest extends TestCase
+{
+    use PreventSavingStacheItemsToDisk;
+
+    public static function hiddenPermissionProvider()
+    {
+        return [
+            'entries' => ['view {collection} entries', 'configure collections'],
+            'navs' => ['view {nav} nav', 'configure navs'],
+            'globals' => ['edit {global} globals', 'configure globals'],
+            'terms' => ['view {taxonomy} terms', 'configure taxonomies'],
+            'assets' => ['view {container} assets', 'configure asset containers'],
+            'form submissions' => ['view {form} form submissions', 'configure forms'],
+        ];
+    }
+
+    #[Test]
+    #[DataProvider('hiddenPermissionProvider')]
+    public function configure_permissions_hide_their_per_item_permissions($permission, $hider)
+    {
+        $this->assertEquals([$hider], Permission::boot()->get($permission)->hiddenBy());
+    }
+
+    #[Test]
+    public function child_permissions_are_not_hidden_since_their_parents_are()
+    {
+        $this->assertEquals([], Permission::boot()->get('edit {collection} entries')->hiddenBy());
+        $this->assertEquals([], Permission::boot()->get('delete {container} assets')->hiddenBy());
+    }
+
+    #[Test]
+    public function replaced_child_permissions_keep_their_descriptions()
+    {
+        Collection::make('blog')->save();
+
+        $group = Permission::boot()->tree()->firstWhere('handle', 'collections');
+        $view = collect($group['permissions'])->firstWhere('value', 'view blog entries');
+        $edit = collect($view['children'])->firstWhere('value', 'edit blog entries');
+        $publish = collect($edit['children'])->firstWhere('value', 'publish blog entries');
+
+        $this->assertEquals(__('statamic::permissions.publish_{collection}_entries_desc'), $publish['description']);
+    }
+
+    #[Test]
+    public function site_access_is_not_hidden_by_configuring_sites()
+    {
+        $this->setSites([
+            'en' => ['url' => '/', 'locale' => 'en_US', 'name' => 'English'],
+            'fr' => ['url' => '/fr/', 'locale' => 'fr_FR', 'name' => 'French'],
+        ]);
+
+        $this->assertEquals([], Permission::boot()->get('access {site} site')->hiddenBy());
+    }
+}
diff --git a/tests/Permissions/PermissionTest.php b/tests/Permissions/PermissionTest.php
index daa1aec1168..76738dd9d05 100644
--- a/tests/Permissions/PermissionTest.php
+++ b/tests/Permissions/PermissionTest.php
@@ -20,6 +20,7 @@ public function it_makes_a_tree()
                 'label' => 'one',
                 'description' => null,
                 'group' => null,
+                'hidden_by' => [],
                 'children' => [],
             ],
         ], $permission->toTree());
@@ -42,12 +43,14 @@ public function it_makes_tree_with_children()
                 'label' => 'parent',
                 'description' => null,
                 'group' => 'foo',
+                'hidden_by' => [],
                 'children' => [
                     [
                         'value' => 'child',
                         'label' => 'Child!',
                         'description' => null,
                         'group' => 'foo',
+                        'hidden_by' => [],
                         'children' => [],
                     ],
                 ],
@@ -135,6 +138,90 @@ public function it_adds_a_group()
         $this->assertEquals('the-group', $permission->toTree()[0]['group']);
     }
 
+    #[Test]
+    public function it_adds_a_hiding_permission()
+    {
+        $permission = (new Permission)->value('test');
+        $this->assertEquals([], $permission->hiddenBy());
+        $this->assertEquals([], $permission->toTree()[0]['hidden_by']);
+
+        $return = $permission->hiddenBy('other');
+
+        $this->assertEquals($permission, $return);
+        $this->assertEquals(['other'], $permission->hiddenBy());
+        $this->assertEquals(['other'], $permission->toTree()[0]['hidden_by']);
+    }
+
+    #[Test]
+    public function it_adds_multiple_hiding_permissions()
+    {
+        $permission = (new Permission)->value('test')->hiddenBy(['one', 'two']);
+
+        $this->assertEquals(['one', 'two'], $permission->hiddenBy());
+        $this->assertEquals(['one', 'two'], $permission->toTree()[0]['hidden_by']);
+    }
+
+    #[Test]
+    public function it_keeps_the_hiding_permissions_when_replacements_are_defined()
+    {
+        $permission = (new Permission)
+            ->value('edit {handle} form')
+            ->hiddenBy(['configure forms', 'edit forms'])
+            ->replacements('handle', function () {
+                return [
+                    ['value' => 'first', 'label' => 'FIRST'],
+                    ['value' => 'second', 'label' => 'SECOND'],
+                ];
+            });
+
+        $expected = ['configure forms', 'edit forms'];
+
+        $this->assertEquals([$expected, $expected], $permission->permissions()->map->hiddenBy()->all());
+        $this->assertEquals($expected, $permission->toTree()[0]['hidden_by']);
+        $this->assertEquals($expected, $permission->toTree()[1]['hidden_by']);
+    }
+
+    #[Test]
+    public function it_keeps_the_hiding_permissions_of_children_when_replacements_are_defined()
+    {
+        $permission = (new Permission)
+            ->value('view {handle} entries')
+            ->children([
+                (new Permission)
+                    ->value('publish {handle} entries')
+                    ->hiddenBy('configure collections'),
+            ])
+            ->replacements('handle', function () {
+                return [['value' => 'first', 'label' => 'FIRST']];
+            });
+
+        $child = $permission->toTree()[0]['children'][0];
+
+        $this->assertEquals('publish first entries', $child['value']);
+        $this->assertEquals(['configure collections'], $child['hidden_by']);
+    }
+
+    #[Test]
+    public function it_keeps_the_descriptions_when_replacements_are_defined()
+    {
+        $permission = (new Permission)
+            ->value('view {handle} entries')
+            ->description('View the entries')
+            ->children([
+                (new Permission)
+                    ->value('publish {handle} entries')
+                    ->description('Change the publish state'),
+            ])
+            ->replacements('handle', function () {
+                return [['value' => 'first', 'label' => 'FIRST']];
+            });
+
+        $parent = $permission->toTree()[0];
+
+        $this->assertEquals('View the entries', $parent['description']);
+        $this->assertEquals('Change the publish state', $parent['children'][0]['description']);
+    }
+
     #[Test]
     public function it_gets_its_permissions_when_replacements_are_not_defined()
     {
@@ -217,18 +304,21 @@ public function it_combines_replacements_and_children()
                 'label' => 'view FIRST entries',
                 'description' => null,
                 'group' => 'test-group',
+                'hidden_by' => [],
                 'children' => [
                     [
                         'value' => 'edit first entries',
                         'label' => 'edit FIRST entries',
                         'description' => null,
                         'group' => 'test-group',
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'delete first entries',
                                 'label' => 'delete FIRST entries',
                                 'description' => null,
                                 'group' => 'test-group',
+                                'hidden_by' => [],
                                 'children' => [],
                             ],
                         ],
@@ -238,6 +328,7 @@ public function it_combines_replacements_and_children()
                         'label' => 'publish FIRST entries',
                         'description' => null,
                         'group' => 'test-group',
+                        'hidden_by' => [],
                         'children' => [],
                     ],
                 ],
@@ -247,18 +338,21 @@ public function it_combines_replacements_and_children()
                 'label' => 'view SECOND entries',
                 'description' => null,
                 'group' => 'test-group',
+                'hidden_by' => [],
                 'children' => [
                     [
                         'value' => 'edit second entries',
                         'label' => 'edit SECOND entries',
                         'description' => null,
                         'group' => 'test-group',
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'delete second entries',
                                 'label' => 'delete SECOND entries',
                                 'description' => null,
                                 'group' => 'test-group',
+                                'hidden_by' => [],
                                 'children' => [],
                             ],
                         ],
@@ -268,6 +362,7 @@ public function it_combines_replacements_and_children()
                         'label' => 'publish SECOND entries',
                         'description' => null,
                         'group' => 'test-group',
+                        'hidden_by' => [],
                         'children' => [],
                     ],
                 ],
diff --git a/tests/Permissions/PermissionsTest.php b/tests/Permissions/PermissionsTest.php
index e396e78b2f3..390d621c551 100644
--- a/tests/Permissions/PermissionsTest.php
+++ b/tests/Permissions/PermissionsTest.php
@@ -171,18 +171,21 @@ public function it_makes_a_tree()
                         'label' => 'two',
                         'description' => null,
                         'group' => 'test',
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'child-three',
                                 'label' => 'child-three',
                                 'description' => null,
                                 'group' => 'test',
+                                'hidden_by' => [],
                                 'children' => [
                                     [
                                         'value' => 'nested-child',
                                         'label' => 'nested-child',
                                         'description' => null,
                                         'group' => 'test',
+                                        'hidden_by' => [],
                                         'children' => [],
                                     ],
                                 ],
@@ -200,18 +203,21 @@ public function it_makes_a_tree()
                         'label' => 'four FIRST',
                         'description' => null,
                         'group' => 'group-with-replacements',
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'replaced child first',
                                 'label' => 'Replaced FIRST',
                                 'description' => null,
                                 'group' => 'group-with-replacements',
+                                'hidden_by' => [],
                                 'children' => [
                                     [
                                         'value' => 'replaced nested child first',
                                         'label' => 'Replaced Nested FIRST',
                                         'description' => null,
                                         'group' => 'group-with-replacements',
+                                        'hidden_by' => [],
                                         'children' => [],
                                     ],
                                 ],
@@ -223,18 +229,21 @@ public function it_makes_a_tree()
                         'label' => 'four SECOND',
                         'description' => null,
                         'group' => 'group-with-replacements',
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'replaced child second',
                                 'label' => 'Replaced SECOND',
                                 'description' => null,
                                 'group' => 'group-with-replacements',
+                                'hidden_by' => [],
                                 'children' => [
                                     [
                                         'value' => 'replaced nested child second',
                                         'label' => 'Replaced Nested SECOND',
                                         'description' => null,
                                         'group' => 'group-with-replacements',
+                                        'hidden_by' => [],
                                         'children' => [],
                                     ],
                                 ],
@@ -252,12 +261,14 @@ public function it_makes_a_tree()
                         'label' => 'one',
                         'description' => null,
                         'group' => null,
+                        'hidden_by' => [],
                         'children' => [
                             [
                                 'value' => 'child-one',
                                 'label' => 'child-one',
                                 'description' => null,
                                 'group' => null,
+                                'hidden_by' => [],
                                 'children' => [],
                             ],
                             [
@@ -265,6 +276,7 @@ public function it_makes_a_tree()
                                 'label' => 'child-two',
                                 'description' => null,
                                 'group' => null,
+                                'hidden_by' => [],
                                 'children' => [],
                             ],
                         ],
@@ -274,6 +286,7 @@ public function it_makes_a_tree()
                         'label' => 'three',
                         'description' => null,
                         'group' => null,
+                        'hidden_by' => [],
                         'children' => [],
                     ],
                 ],
diff --git a/tests/Policies/EntryPolicyTest.php b/tests/Policies/EntryPolicyTest.php
index db40d4cd835..eb6aa35213a 100644
--- a/tests/Policies/EntryPolicyTest.php
+++ b/tests/Policies/EntryPolicyTest.php
@@ -151,6 +151,32 @@ public function entry_is_not_creatable_without_create_and_site_permissions()
         $this->assertFalse($user->can('create', [Entry::class, $collection]));
     }
 
+    #[Test]
+    public function user_with_configure_permission_can_do_it_all()
+    {
+        $userWithPermission = $this->userWithPermissions(['configure collections']);
+        $userWithoutPermission = $this->userWithPermissions([]);
+
+        $collection = tap(Collection::make('alfa'))->save();
+        $entry = EntryFactory::id('1')->collection($collection)->create();
+
+        $this->assertTrue($userWithPermission->can('view', $entry));
+        $this->assertTrue($userWithPermission->can('edit', $entry));
+        $this->assertTrue($userWithPermission->can('update', $entry));
+        $this->assertTrue($userWithPermission->can('create', [Entry::class, $collection]));
+        $this->assertTrue($userWithPermission->can('store', [Entry::class, $collection]));
+        $this->assertTrue($userWithPermission->can('delete', $entry));
+        $this->assertTrue($userWithPermission->can('publish', $entry));
+
+        $this->assertFalse($userWithoutPermission->can('view', $entry));
+        $this->assertFalse($userWithoutPermission->can('edit', $entry));
+        $this->assertFalse($userWithoutPermission->can('update', $entry));
+        $this->assertFalse($userWithoutPermission->can('create', [Entry::class, $collection]));
+        $this->assertFalse($userWithoutPermission->can('store', [Entry::class, $collection]));
+        $this->assertFalse($userWithoutPermission->can('delete', $entry));
+        $this->assertFalse($userWithoutPermission->can('publish', $entry));
+    }
+
     #[Test]
     public function another_authors_entry_is_editable()
     {
diff --git a/tests/Policies/GlobalSetVariablesPolicyTest.php b/tests/Policies/GlobalSetVariablesPolicyTest.php
index e95e6f58607..1605447be50 100644
--- a/tests/Policies/GlobalSetVariablesPolicyTest.php
+++ b/tests/Policies/GlobalSetVariablesPolicyTest.php
@@ -41,6 +41,20 @@ public function variables_are_editable_with_edit_and_site_permissions()
         $this->assertTrue($user->can('view', $global->in('de')));
     }
 
+    #[Test]
+    public function variables_are_viewable_and_editable_with_configure_permission()
+    {
+        $forbiddenUser = $this->userWithPermissions([]);
+        $authorizedUser = $this->userWithPermissions(['configure globals']);
+        $variables = tap(GlobalSet::make('test'))->save()->inDefaultSite();
+
+        $this->assertTrue($authorizedUser->can('view', $variables));
+        $this->assertTrue($authorizedUser->can('edit', $variables));
+
+        $this->assertFalse($forbiddenUser->can('view', $variables));
+        $this->assertFalse($forbiddenUser->can('edit', $variables));
+    }
+
     #[Test]
     public function variables_can_be_created_with_configure_permission()
     {
diff --git a/tests/Policies/TermPolicyTest.php b/tests/Policies/TermPolicyTest.php
index 49bfed15f22..c8a1c67181b 100644
--- a/tests/Policies/TermPolicyTest.php
+++ b/tests/Policies/TermPolicyTest.php
@@ -105,4 +105,30 @@ public function term_is_not_creatable_without_create_and_site_permissions()
         // If no site is specified, it should avoid checking site access.
         $this->assertFalse($user->can('create', [TermContract::class, $taxonomy]));
     }
+
+    #[Test]
+    public function user_with_configure_permission_can_do_it_all()
+    {
+        $userWithPermission = $this->userWithPermissions(['configure taxonomies']);
+        $userWithoutPermission = $this->userWithPermissions([]);
+
+        $taxonomy = tap(Taxonomy::make('tags'))->save();
+        $term = tap(Term::make()->taxonomy('tags')->inDefaultLocale()->slug('alfa')->data([]))->save()->term();
+
+        $this->assertTrue($userWithPermission->can('view', $term));
+        $this->assertTrue($userWithPermission->can('edit', $term));
+        $this->assertTrue($userWithPermission->can('update', $term));
+        $this->assertTrue($userWithPermission->can('create', [TermContract::class, $taxonomy]));
+        $this->assertTrue($userWithPermission->can('store', [TermContract::class, $taxonomy]));
+        $this->assertTrue($userWithPermission->can('delete', $term));
+        $this->assertTrue($userWithPermission->can('publish', $term));
+
+        $this->assertFalse($userWithoutPermission->can('view', $term));
+        $this->assertFalse($userWithoutPermission->can('edit', $term));
+        $this->assertFalse($userWithoutPermission->can('update', $term));
+        $this->assertFalse($userWithoutPermission->can('create', [TermContract::class, $taxonomy]));
+        $this->assertFalse($userWithoutPermission->can('store', [TermContract::class, $taxonomy]));
+        $this->assertFalse($userWithoutPermission->can('delete', $term));
+        $this->assertFalse($userWithoutPermission->can('publish', $term));
+    }
 }