Laravel Policy Scaffold Skill

Use this skill when defining authorization logic.

Rules

1. User Type

• Always type hint the User model explicitly: public function update(User $user, Post $post): bool.

2. Permissions vs Roles

• Prefer Permissions: Use $user->can('update posts') rather than hardcoded role checks like $user->role == 'admin'.
• Super Admin: Remember that specific packages (like Spatie Permission) might handle Super Admin auto-approval via Gate. Ensure before() method usage if manual override is needed.

3. Filament Integration

• Filament relies heavily on Policies. Ensure all methods (viewAny, view, create, update, delete, restore, forceDelete) are implemented.
• Return false by default for methods that shouldn’t be accessed.

public function viewAny(User $user): bool
{
    return $user->can('view_any_post');
}