Spatie Permissions vs Laravel Policies and Gates: Handling Role-Based Access

Alright, so you’re building a Laravel app and need to handle role-based access control (RBAC). You’ve probably come across Laravel’s built-in Policies and Gates, but then there's also Spatie Permissions. Which one should you go for? Let's explore our options.

1. What’s the Deal with Laravel Policies and Gates?

Laravel gives you two built-in ways to handle authorization: Gates and Policies. Think of them as lightweight ways to check if a user can do something.

Laravel Gates

Gates are like simple yes/no checkpoints that decide whether a user is allowed to perform an action. You define them in AuthServiceProvider.

use Illuminate\Support\Facades\Gate;

Gate::define('edit-post', function (User $user, Post $post) {
    return $user->id === $post->user_id;
});

// then, when you want to check if a user has permission:

if (Gate::allows('edit-post', $post)) {
    // The user can edit the post
}

How Gates Work Behind the Scenes

Gates function as simple closure-based authorization checks that Laravel stores in memory during a request. When a Gate is evaluated, Laravel runs the defined logic and determines whether the action is allowed. Gates do not persist permissions in a database, meaning authorization is determined at runtime.

Laravel Policies

Policies are like organized rulebooks that group all the authorization logic for a specific model.

Making a policy for the Post model:

php artisan make:policy PostPolicy

// now, inside PostPolicy.php, you define rules like this:

public function update(User $user, Post $post) {
    return $user->id === $post->user_id;
}

// and to check if a user can update a post

if ($user->can('update', $post)) {
    // User can update the post
}

How Policies Work Behind the Scenes

Policies work similarly to Gates but provide a more structured approach by associating authorization rules with specific models. Laravel automatically resolves the correct policy for a model based on method naming conventions. When a policy method is invoked, Laravel checks if an authenticated user meets the defined conditions before granting or denying access.

2. Spatie Permissions: The Big Guns for RBAC

Now, if you need something fancier—like full-blown role management—Spatie Permissions has got your back. It lets you store roles and permissions in the database and manage them dynamically.

composer require spatie/laravel-permission

After running migrations, you can create roles and permissions like this:

use Spatie\Permission\Models\Role;
use Spatie\Permission\Models\Permission;

Role::create(['name' => 'admin']);
Permission::create(['name' => 'edit posts']);

$admin = User::find(1);
$admin->assignRole('admin');
$admin->givePermissionTo('edit posts');

// checking for roles and permissions is easy:

if ($user->hasRole('admin')) {
    // User is an admin
}

if ($user->can('edit posts')) {
    // User can edit posts
}

3. Let’s Compare

4. So, Which One Should You Use?

Laravel Policies and Gates if:

• your app just needs simple, per-model access control
• you don’t need roles, just permissions
• you want something lightweight and baked into Laravel

Spatie Permissions if:

• you need full-on roles and permissions stored in the database
• you want to assign roles dynamically without touching the code
• you’re building a bigger app that needs scalable RBAC

Conclusion

At the end of the day, both Laravel’s built-in authorization and Spatie Permissions are solid choices—it just depends on your needs. If your app is small and doesn’t need roles, stick with Laravel’s built-in tools. But if you need a flexible, database-driven RBAC system, Spatie Permissions is the way to go!

Hope this clears things up! Which one are you thinking of using?