Bastion Laravel Package

Product Decisions This Supports

• Build vs. buy for admin-panel authorization. Bastion sits between Filament's native policy checks and a hand-rolled RBAC layer. v4.1.0's "Parent Resource Check Compatibility" means nested/parent-child resources inherit authorization correctly out of the box — that's typically the first thing a team hand-rolls and the first thing that breaks. Adopting the package removes a recurring maintenance line item from the roadmap.
• Multi-panel architecture decisions. BastionSyncCommand now accepts an optional Panel argument. This directly unblocks the "one Filament install, several audiences" pattern (internal admin + partner portal + support console) by letting permission sync be scoped per panel instead of globally. If multi-panel is on the roadmap, this release is the enabler; if it isn't, this is a cheap future option.
• Upgrade sequencing. The 3.x → 4.x jump is a Filament v4 alignment, not an incremental feature drop. That makes it a dependency-graph decision: it dictates when the product can take Filament v4 (and therefore Laravel 11 / PHP 8.2+), which cascades into hosting, CI, and any other Filament plugins in the stack. Treat it as a platform upgrade workstream, not a composer bump.
• Feature scoping for permissions UI. If Bastion owns the roles/permissions surface, "who can edit roles" and "how are they audited" become package questions rather than design questions — useful for cutting scope on an internal-tools milestone.
• Use cases it fits: internal back-office tools, multi-tenant admin panels, agencies shipping Filament apps with per-client role matrices, and any product where authorization is table stakes rather than differentiation.

When to Consider This Package

Adopt when:

• The application is already on Filament, and the panel needs role/permission enforcement across resources rather than a handful of one-off Gates.
• You have nested or parent-child resources — the v4.1.0 parent-resource check compatibility is the specific feature that makes complex resource trees safe.
• You run or plan multiple panels with distinct permission sets; the new panel-scoped sync command is the differentiator here.
• Authorization is undifferentiated work: you want it configured and audited, not invented. Buying here frees engineering time for the actual product.
• You can absorb the Filament v4 baseline (PHP 8.2+, Laravel 11+, and compatibility with your other Filament plugins).

Look elsewhere or defer when:

• You're not on Filament, or you're on Filament v3 and cannot move yet — 4.x is a hard break, and staying on 3.0.1 means accepting an unmaintained branch.
• Authorization is core product surface (e.g., a permissions product sold to customers, complex ABAC/ReBAC, delegated administration with policy authoring). A package's opinionated model will fight you; build or use a dedicated authorization engine.
• You need formal support, SLAs, or a security response commitment. This is a single-maintainer package — plan for the bus factor and pin versions.
• Your access model is trivially small (one admin role, one gate). The integration surface costs more than it saves.

How to Pitch It (Stakeholders)

For executives: Bastion is an access-control layer for the admin panels we build on Filament. The new 4.x release brings us onto Filament v4 and adds two capabilities we would otherwise have to build ourselves: correct authorization on nested resources, and per-panel permission syncing for products that serve more than one audience from a single install. The trade-off is an upgrade project — Filament v4 moves our PHP and Laravel floor — which we should schedule deliberately rather than let it ride along with feature work. It is a small, single-maintainer dependency; the recommendation is to adopt with pinned versions and no expectation of vendor support.

For engineering: v4.1.0 is a major-version bump driven by Filament v4 compatibility (parent resource checks now behave correctly under the v4 authorization flow), plus the sync command taking an optional panel argument so permission provisioning can be targeted per panel instead of run globally. Upgrading is bounded work but not free: it forces the Filament v4 / Laravel 11 / PHP 8.2 baseline and any sibling Filament plugins must be v4-ready first. Sequence it as a standalone PR with the other Filament packages, verify nested-resource authorization and the sync command under each panel, and pin to a tested range given the single-maintainer risk.