Policies and Gates for Authorization
Beyond broad roles, applications often need to answer more specific questions: can this user edit this particular post? Laravel handles this kind of fine-grained authorization through two related tools — Gates and Policies.
Gates
A Gate is a simple closure-based way to define authorization logic, typically registered in a service provider. Gates work well for actions that aren't tied to a specific Eloquent model, like accessing an admin dashboard.
Policies
A Policy is a dedicated class for organizing authorization logic around a specific model, such as a Post or Comment. Each method on a policy typically corresponds to an action, like update or delete, and receives the current user along with the relevant model instance.
| Tool | Best For |
|---|---|
| Gate | Simple, model-independent checks, like admin access |
| Policy | Authorization logic scoped to a specific Eloquent model |
Gate::allows() | Checking a gate's result directly in code |
$user->can('update', $post) | Checking a policy method through the authorizable user |
@can (Blade) | Conditionally showing UI based on an authorization check |
Why Separate Authorization From Business Logic
- Keeps controllers focused on actions, not permission checks
- Makes authorization rules reusable across controllers, views, and API responses
- Provides a single, testable place to verify who can do what
Policies and gates decide what a request is allowed to do once it reaches a controller — but often you want to intercept a request even earlier, before it gets that far. That's exactly the role middleware plays in a Laravel application.
Ready to master Laravel Training Course?
Join Uncodemy's hands-on Laravel program and build real, production-ready applications.