Laravel Policies and Gates: authorize actions in controllers

PHP Dasun Kalupahana November 2, 2026 41 views

<?php

// php artisan make:policy PostPolicy --model=Post
public function update(User $user, Post $post): bool
{
    return $user->id === $post->user_id;
}

// Controller
use Illuminate\Support\Facades\Gate;

public function update(Request $request, Post $post)
{
    Gate::authorize('update', $post);
    // ...
}

Keeps permission rules in one policy class instead of scattering if checks. Gate::authorize throws a 403 when the check fails.

#laravel #authorization #policy #gate #security