Authorization Laravel Package

Product Decisions This Supports

• Build vs. buy on authorization. Whether we hand-roll permission checks or adopt an externalized policy/ability model — the decision that determines how expensive every future role, scope, and plan-tier change becomes.
• Roadmap gating for access-control features. Multi-tenant workspaces, sharing/invite models, API token scopes, admin permission-management UI, and enterprise SSO role mapping all sit downstream of the authorization architecture choice.
• Architecture standardization. Committing to PSR-15 middleware as a single enforcement point keeps authorization portable across services and frameworks instead of re-implemented per app.
• Compliance and auditability work. SOC 2 / ISO 27001 access-control evidence is dramatically cheaper when "who can do what" lives in named policies rather than scattered if ($user->isAdmin()) branches.
• Security posture calls. Centralized deny-by-default policies reduce the class of bug where a new endpoint ships without a permission check.

When to Consider This Package

Consider it when:

• You are on CakePHP 4/5 — this is the native, maintained authorization layer.
• You already run a PSR-7/PSR-15 middleware stack (Slim, Mezzio, custom) and want policy-based authorization not welded to a framework.
• You want a small, MIT-licensed library with a clean policy/identity contract rather than a full IAM suite or hosted vendor.

Framework-fit caveat — read this first: despite the brief, this is a CakePHP ecosystem package, not a Laravel package. There is no Laravel service provider, no Gate/Policy bridge, no Eloquent or Blade helpers. Using it in Laravel means bridging PSR-15 middleware into the HTTP kernel and writing a custom policy resolver — real integration cost, and we would be an atypical user of it.

Look elsewhere when:

• The stack is Laravel. Native Gate/Policies cost nothing and are framework-supported; pair with spatie/laravel-permission for role storage. Lower total cost, easier hiring and onboarding.
• You need an admin UI for permission editing, attribute-based rules over external data, or relationship-based access (ReBAC) — evaluate OPA/Cedar, Casbin, or a hosted product (Auth0 FGA, Permify, Oso) instead.
• You need vendor SLAs, security disclosures with response commitments, or a large community for support.

Risk flags for the decision record: ~74 GitHub stars and thin adoption imply a small maintainer pool and limited community answers when we hit edge cases. The release metadata (2026-07-07) should be verified before we depend on it. Budget a contingency to fork or migrate; at this size the library is small enough to vendor.

How to Pitch It (Stakeholders)

Executives: This is a small, MIT-licensed authorization library — no license fees and no procurement. It is only relevant if we run CakePHP or already operate PSR-15 middleware. On Laravel it is the wrong tool, and framework-native features cover us at zero cost. Recommendation: no new spend; treat it as a reference design for centralized, policy-based authorization while we standardize our own approach.

Engineering: It moves authorization into named policy classes evaluated by PSR-15 middleware — one enforcement point, testable policy units, and no role checks leaking into controllers. Clean seams for tenant scoping and audit logging. The trade-offs are CakePHP-first ergonomics, no Laravel bindings, a very small community, and a 1–2 day spike to prove PSR-15 bridging before committing. Strong fit for CakePHP services; for Laravel, Gate/Policies deliver the same pattern with first-party support.

Decision ask: Approve a short spike only if a CakePHP or PSR-15 service is in scope this quarter. Otherwise adopt its policy pattern internally and stay on framework-native tooling.