Authorization in PHP
From the Laravel cheat sheet · Authentication & Authorization · verified Jul 2026
Authorization
Gates and policies for authorization
php
// Gates
Gate::define('edit-post', function ($user, $post) {
return $user->id === $post->user_id;
});
if (Gate::allows('edit-post', $post)) {
// User can edit
}
// Policies
php artisan make:policy PostPolicy --model=Post
// In controller
$this->authorize('update', $post);💡 Gates are simple closures, policies are classes for models
⚡ Use before() hook for super admin bypass
📌 Policies automatically discovered if naming convention followed
🔥 authorize() method throws 403 exception if unauthorized