    public function destroy(Appointment $appointment)
    {
        if (!auth()->user()->can("appointment-create")) {
            return response("Access denied", 403);
        }

        $deleted = $appointment->delete();
        if ($deleted) {
            return response("Success");
        }
        return response("Error", 503);
    }
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.