Psr3 Bridge Laravel Package

Product Decisions This Supports

• Authorization observability, not a feature. This package is a thin adapter that routes php-casbin's internal logger into any PSR-3 logger (Monolog, Laravel's logger, etc.). The product decision it enables is: "Do authorization decisions and policy-evaluation errors land in the same observability pipeline as the rest of the app?" Without it, Casbin's default logger is a basic echo-based sink, which means permission denials and policy load failures are effectively invisible in production.
• Access-control auditability and support tooling. Once routed into a PSR-3 sink, Casbin events can flow to Datadog/Splunk/CloudWatch and answer "why was this user denied?", "when did this role grant change take effect?", and "which requests hit the policy after the last deploy?" That is compliance evidence (SOC 2 access-control narratives) and a support-cost reducer.
• Safer policy rollouts. Logging Casbin in shadow/canary mode lets you compare new policy sets against the previous behavior before enforcement flips over — a cheap de-risking step for any RBAC/ABAC migration.
• Build vs. buy: a "borrow" decision, not a buy decision. The package is one small adapter class under Apache-2.0. The real PM decision is dependency governance: take a 2-star, zero-dependent, single-release (Feb 2022) package into the lockfile, or spend an afternoon implementing the same interface in-house. Given the score and adoption profile, in-house/vendored is the defensible default.
• Not a roadmap item. Treat it as plumbing inside the authorization workstream — no user-facing surface, no marketing angle, negligible effort, so it should be decided by the engineering lead under an existing dependency policy, not scheduled as product scope.

When to Consider This Package

Consider it when:

• You are already running php-casbin and have a PSR-3-compatible logger as the house standard (nearly all modern PHP/Laravel apps do).
• You need Casbin's log output unified with application logs — consistent severity levels, structured context, and a single destination — rather than a separate ad-hoc channel.
• You want the fastest path to "authorization errors and denials are queryable," and you accept the maintenance profile.
• You need a reference implementation to copy: Apache-2.0 permits vendoring the source with attribution, which is likely the better move.

Look elsewhere or skip it when:

• You are not using Casbin (Laravel's native Gate/Policy, Symfony Security, or an external PDP such as OPA/Cedar makes this irrelevant).
• You need audit-grade records. PSR-3 log lines are free-text, mutable, and retention-bound by your logging vendor — they are not a tamper-evident audit ledger. If the requirement is regulatory evidence, budget for a dedicated append-only audit store and treat logs as a debugging aid only.
• Your dependency policy bars single-maintainer, stale, zero-adoption packages. Last release 2022 and no dependents means no upstream security response; the mitigation is to vendor the adapter and own it.
• Performance-sensitive hot paths: logging every enforcement call adds I/O; if you log at debug level per request, plan sampling or level gating first.

How to Pitch It (Stakeholders)

For executives: This is a small, low-cost piece of plumbing that makes our authorization system observable. It doesn't add a customer-facing feature, but it converts "a user says they can't access something" from an engineering investigation into a log query, and it gives us a defensible record of access decisions for compliance reviews. Effort is negligible; the risk is that the package itself is a nearly-unmaintained open-source shim, so we should copy its small amount of code into our own repository and own it rather than depend on it. Net: low cost, reduced operational and compliance risk, no roadmap impact.

For engineering: It's a single adapter implementing Casbin's logger interface and delegating to Psr\Log\LoggerInterface; Apache-2.0 means we can vendor it with attribution in under an hour. Recommendation: don't add a 2-star, zero-dependent, 2022-era package to the dependency graph — reimplement or vendor, wire it into the existing log channel, tag Casbin entries with a stable context key (user, resource, action, decision, policy version) so they're queryable, and gate per-request debug logging behind a config flag to control volume.