The Laravel Authorization Cookbook: 12 Production-Ready Recipes for RBAC, ABAC, Teams & Deny Rules

composer require hosseinhezami/laravel-permission-manager
php artisan vendor:publish --provider="HosseinHezami\PermissionManager\PermissionManagerServiceProvider" --tag="migrations"
php artisan migrate

// app/Models/User.php
use HosseinHezami\PermissionManager\Traits\PermissionTrait;

class User extends Authenticatable
{
    use PermissionTrait;
}

use HosseinHezami\PermissionManager\Models\Role;

$editor = Role::create(['name' => 'Editor', 'slug' => 'editor']);

// One wildcard instead of ten lines
$editor->assignPermission('posts.*');

$user->assignRole('editor');

$user->hasPermissionTo('posts.view');    // ✅ true
$user->hasPermissionTo('posts.publish'); // ✅ true
$user->hasPermissionTo('users.delete');  // ❌ false

$sarah->givePermissionTo('reports.export');

$sarah->hasDirectPermission('reports.export'); // ✅ true
$sarah->hasPermissionTo('reports.export');     // ✅ true (direct counts)

$sarah->revokePermissionTo('reports.export');

$intern = Role::create(['name' => 'Intern', 'slug' => 'intern']);

$intern->assignPermission('posts.*');      // grant everything...
$intern->denyPermission('posts.delete');   // ...except this

$user->assignRole('intern');

$user->hasPermissionTo('posts.edit');   // ✅ true
$user->hasPermissionTo('posts.delete'); // ❌ false — deny always wins

$viewer->assignPermission('posts.view');
$editor->assignPermission('posts.edit');
$admin->assignPermission('users.manage');

$editor->inheritFrom('viewer');
$admin->inheritFrom('editor');

// An admin now holds ALL of these:
$user->assignRole('admin');
$user->hasPermissionTo('posts.view');  // ✅ from viewer (2 levels down)
$user->hasPermissionTo('posts.edit');  // ✅ from editor (1 level down)
$user->hasPermissionTo('users.manage'); // ✅ direct

php artisan permission:tree

use HosseinHezami\PermissionManager\Models\Permission;
use HosseinHezami\PermissionManager\Models\PermissionCondition;

PermissionCondition::create([
    'permission_id' => Permission::findByRoute('posts.update')->id,
    'name' => 'owner-only',
    'conditions' => [
        'field' => 'user.id',
        'operator' => '=',
        'value' => 'resource.owner_id',
    ],
]);

$user->canPermission('posts.update', $myPost);      // ✅ owns it
$user->canPermission('posts.update', $someoneElses); // ❌ not the owner

PermissionCondition::create([
    'permission_id' => Permission::findByRoute('expenses.approve')->id,
    'name' => 'dept-manager-limit',
    'conditions' => [
        'all' => [
            ['field' => 'user.department_id', 'operator' => '=', 'value' => 'resource.department_id'],
            ['field' => 'resource.amount', 'operator' => '<=', 'value' => 1000],
        ],
    ],
]);

$manager->canPermission('expenses.approve', $teamExpense);    // ✅ same dept, $500
$manager->canPermission('expenses.approve', $otherDeptExpense); // ❌ different dept
$manager->canPermission('expenses.approve', $bigExpense);      // ❌ $5,000

use HosseinHezami\PermissionManager\Models\Team;

$acme = Team::createTeam(['name' => 'Acme Corp', 'slug' => 'acme']);
$globex = Team::createTeam(['name' => 'Globex Inc', 'slug' => 'globex']);

$ana->joinTeam($acme);
$ana->joinTeam($globex);

$ana->assignRoleForTeam('admin', $acme);
$ana->assignRoleForTeam('viewer', $globex);

$ana->hasRoleForTeam('admin', $acme);   // ✅
$ana->hasRoleForTeam('admin', $globex); // ❌

Route::middleware(['auth', 'pm.team:header,X-Team-Id'])->group(function () {
    // All permission checks inside respect the active team
});

$contractor->givePermissionTo(
    'billing.view',
    'allow',
    now()->addDays(30)   // expires automatically
);

// Today: ✅ true
// Day 31: ❌ false — without you touching anything

php artisan permission:prune --days=7

// OR — any of these
Route::get('/reports', [ReportController::class, 'index'])
    ->middleware('pm:permission:any:reports.view|reports.export');

// AND — all of these
Route::post('/projects', [ProjectController::class, 'store'])
    ->middleware('pm:permission:all:projects.view|projects.create');

// NOT — must NOT have this
Route::get('/public', fn () => '...')
    ->middleware('pm:permission:not:admin.panel');

// Role + permission combined
Route::delete('/projects/{project}', [ProjectController::class, 'destroy'])
    ->middleware(['pm:role:admin', 'pm:permission:projects.delete']);

@role('admin')
    <a href="{{ route('admin.settings') }}">Settings</a>
@endrole

@canpermission('posts.update', $post)
    <button wire:click="edit({{ $post->id }})">Edit</button>
@endcanpermission

@hasanyrole(['admin', 'editor'])
    <div class="editor-toolbar">…</div>
@endhasanyrole

@unlesspermission('posts.delete')
    <span class="muted">Deleting is disabled for your account.</span>
@endunlesspermission

use HosseinHezami\PermissionManager\Models\PermissionAudit;

// Everything that happened recently
PermissionAudit::latest()->limit(50)->get();

// Everything one admin did
PermissionAudit::byActor($adminId)->get();

// Only grants of deny rules
PermissionAudit::action('granted')->where('effect', 'deny')->get();

'audit' => ['enabled' => true, 'log_mutations' => true],

php artisan permission:why 42 posts.delete

  User:    42
  Ability: posts.delete
  ✗ DENIED
  Reason:  explicit_user_deny
  Source:  direct_permission
  Details:
    - matched_pattern: posts.delete

$result = PermissionManager::explain($user, 'posts.delete');
// ['allowed' => false, 'reason' => 'explicit_user_deny', 'source' => ..., 'user' => [...]]

$snapshot = PermissionManager::snapshot($user);
// roles, allow list, deny list, inherited roles, merged permissions

use HosseinHezami\PermissionManager\Testing\InteractsWithPermissions;
use HosseinHezami\PermissionManager\Testing\PermissionAssertions;

class PostPolicyTest extends TestCase
{
    use InteractsWithPermissions, PermissionAssertions;

    public function test_intern_cannot_delete_posts(): void
    {
        $intern = $this->actingAsRole(['intern']);

        $this->assertHasPermission($intern, 'posts.edit');
        $this->assertDoesNotHavePermission($intern, 'posts.delete');

        $this->deleteJson('/posts/1')->assertStatus(403);
    }
}

composer require hosseinhezami/laravel-permission-manager