Problem
Engineering context
Hiding an edit link does not prevent a crafted request.
Solution boundary
Authorize each protected action on the server.
Authorization
Laravel Policy-Based Authorization
Enforces project update permission at the backend policy boundary.
PHP
Laravel
Intermediate
app/Policies/ProjectPolicy.phpPHP
public function update(User $user, Project $project): bool
{
return $user->can('projects.update')
&& $user->company_id === $project->company_id;
}How it works
How it works
The policy centralises the decision and keeps controllers consistent.
Security considerations
Security considerations
Pair role permission with ownership or tenant checks when records belong to an organisation.
Performance considerations
Performance considerations
Policy checks should use already-loaded context where appropriate without weakening isolation.
Tradeoffs
Tradeoffs
Policies require deliberate coverage for every protected route.
Testing notes
Testing notes
Test allowed, denied and cross-tenant requests.
Limitations
Limitations
Illustrative public-safe example; adapt the boundary and domain rules to the actual application.
Engineering evidence
Connected design context
Continue exploring
Related examples
Laravel Service-Layer Transaction
Coordinates a stock adjustment inside a database transaction while keeping HTTP concerns outside the domain operation.
Transactions
Service Layer
Policy-Based Authorization
Examine the engineering example →