what is best pattern or approach to handle ACL in Eloquent Models?

I'm creating a REST API using Laravel in which there is multiple parameter for an endpoint based on user's role.

Currently checking this in Services, using if conditions.

class UserService
{
    public function update(array $attribute, $userId)
    {
        $userRepository = app(\App\Repositories\UserRepositoryInterface::class);
        $user = $userRepository->get($userId);
        $allowedUpdatableFieldForTeachers = ['name', 'age', 'graduated_at'];
        $allowedUpdatableFieldForSupervisor = ['name', 'age', 'graduated_at', 'balance', 'salary'];
        if ($user->role == 'teacher') {
            $userRepository->update(Arr::only($attribute, $allowedUpdatableFieldForTeachers), $userId);
        }
        if ($user->role == 'supervisor') {
            $userRepository->update(Arr::only($attribute, $allowedUpdatableFieldForSupervisor), $userId);
        }
    }
}

However its violating Single Responsibility Principle. So whats the best practice/pattern to handle this issue.