diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 55e1dc5..3385d3d 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -29,6 +29,20 @@ module ApplicationHelper
     end
   end
 
+  # Badge de papel do usuário (admin/gerente/operador/motorista)
+  def badge_role(role)
+    cfg = case role.to_s
+          when 'admin'     then { cor: 'bg-orange-500 text-black' }
+          when 'gerente'   then { cor: 'bg-orange-800 text-white' }
+          when 'operador'  then { cor: 'bg-gray-700 text-white' }
+          when 'motorista' then { cor: 'bg-gray-900 text-orange-400 border border-orange-500' }
+          else                  { cor: 'bg-gray-800 text-gray-400' }
+          end
+    label = User::ROLES_LABEL[role.to_s] || role.to_s.humanize
+
+    tag.span label, class: "inline-flex items-center px-2.5 py-1 rounded-full text-xs font-bold #{cfg[:cor]}"
+  end
+
   # Barra de progresso laranja
   def progress_bar(percentual, label: nil)
     pct = percentual.to_i.clamp(0, 100)
diff --git a/app/policies/application_policy.rb b/app/policies/application_policy.rb
index b48178e..348a51a 100644
--- a/app/policies/application_policy.rb
+++ b/app/policies/application_policy.rb
@@ -15,6 +15,15 @@ class ApplicationPolicy
   def edit?    = update?
   def destroy? = user.admin?
 
+  # Helpers de papel disponíveis para todas as policies (delegam para o User)
+  def admin?
+    user.admin?
+  end
+
+  def admin_ou_gerente?
+    user.admin? || user.gerente?
+  end
+
   class Scope
     def initialize(user, scope)
       @user  = user
diff --git a/app/policies/user_policy.rb b/app/policies/user_policy.rb
index 12552eb..09dcddd 100644
--- a/app/policies/user_policy.rb
+++ b/app/policies/user_policy.rb
@@ -32,18 +32,7 @@ class UserPolicy < ApplicationPolicy
     admin?
   end
 
-  private
-
-  # Helpers de papel usados pelas permissões acima (delegam para o User)
-  def admin?
-    user.admin?
-  end
-
-  def admin_ou_gerente?
-    user.admin? || user.gerente?
-  end
-
-  public
+  # admin? e admin_ou_gerente? vêm da ApplicationPolicy.
 
   class Scope < Scope
     def resolve
diff --git a/spec/policies/configuracao_policy_spec.rb b/spec/policies/configuracao_policy_spec.rb
new file mode 100644
index 0000000..bb74fe7
--- /dev/null
+++ b/spec/policies/configuracao_policy_spec.rb
@@ -0,0 +1,20 @@
+require 'rails_helper'
+
+RSpec.describe ConfiguracaoPolicy do
+  subject { described_class }
+
+  permissions :index? do
+    it 'libera para admin e gerente, nega operador' do
+      expect(subject).to permit(build(:admin), Configuracao)
+      expect(subject).to permit(build(:gerente), Configuracao)
+      expect(subject).not_to permit(build(:operador), Configuracao)
+    end
+  end
+
+  permissions :edit?, :update? do
+    it 'só admin altera configurações' do
+      expect(subject).to permit(build(:admin), Configuracao)
+      expect(subject).not_to permit(build(:gerente), Configuracao)
+    end
+  end
+end