In Laravel, policies organize authorization logic for model actions. 1. Policies are classes with methods like view, create, update, and delete that return true or false based on user permissions. 2. To register a policy, map the model to its policy in the $policies array of AuthServiceProvider. 3. Use policies in controllers via the authorize() method, which throws an exception if the user is not allowed. 4. You can also check permissions using the can() method directly on the user instance or apply restrictions at the route level using middleware. 5. Policy methods receive the authenticated user and optionally a model instance, allowing for simple or complex authorization rules such as ownership checks or time-based constraints. This structure keeps authorization logic clean, maintainable, and reusable across the application.

In Laravel, policies are a way to organize authorization logic around specific models. Think of them as gatekeepers for actions related to resources — like determining whether a user can view, update, or delete a post, for example.

What Exactly Are Policies?

Policies in Laravel are classes that encapsulate the authorization logic for a particular model. Each policy contains methods that correspond to different actions — such as view, create, update, and delete. These methods return either true or false, indicating whether the currently authenticated user is allowed to perform the given action on a specific model instance.

For instance, if you have a Post model, Laravel expects a corresponding PostPolicy. This makes your code cleaner and more maintainable because all the rules related to posts are grouped together in one place.

You can generate a policy using Artisan:

php artisan make:policy PostPolicy --model=Post

How Do You Register Policies?

After creating a policy, you need to associate it with the corresponding model. This is done in the AuthServiceProvider, which lives in app/Providers/AuthServiceProvider.php.

In that file, you'll find a $policies array where you map models to their respective policies. For example:

use App\Models\Post;
use App\Policies\PostPolicy;

protected $policies = [
    Post::class => PostPolicy::class,
];

This tells Laravel which policy to use when authorizing actions on the Post model.

Once registered, Laravel will automatically resolve and apply the correct policy whenever you call authorization methods like authorize() in a controller.

Using Policies in Controllers

The most common place to use policies is inside controllers. When you're working within a controller method (like edit, update, or destroy), you can call the authorize() method to check whether the current user has permission to perform an action.

Here’s how you might use it:

public function update(Request $request, Post $post)
{
    $this->authorize('update', $post);

    // If authorized, proceed with updating the post...
}

If the user isn’t authorized, Laravel will throw an AuthorizationException, which by default returns a 403 response.

Alternatively, you can use the can() method directly on the user:

if (auth()->user()->can('update', $post)) {
    // User can update the post
}

Or even use middleware to restrict access at the route level:

Route::put('/posts/{post}', [PostController::class, 'update'])->can('update', 'post');

Writing Policy Methods

Each method in a policy class receives the currently authenticated user and the relevant model instance (if applicable). For example, the update method might look like this:

public function update(User $user, Post $post)
{
    return $user->id === $post->user_id;
}

This checks whether the authenticated user is the owner of the post being updated.

Some methods don't require a model instance — like create, which usually just needs to check if the user can create any post at all:

public function create(User $user)
{
    return true; // Allow all users to create posts
}

You can also write more complex logic — for example, allowing updates only within a certain time window:

public function update(User $user, Post $post)
{
    return $user->id === $post->user_id && now()->diffInHours($post->created_at) < 24;
}

This gives users a 24-hour window to edit their posts.

That's the core idea behind policies in Laravel — they help keep your authorization logic clean, organized, and reusable.
They’re not complicated, but they do require some setup and understanding of how Laravel resolves them.
Once you get the hang of it, though, they become a powerful tool for managing access across your app.

The above is the detailed content of What are policies in Laravel, and how are they used?. For more information, please follow other related articles on the PHP Chinese website!