Filament Warden Laravel Package

Product Decisions This Supports

• Upgrade sequencing and calendar planning. v3.5.0 requires elpandape/warden ^3.2 and carries a one-time migration step (php artisan warden:clean --stranded) for anyone coming from warden 3.0.0. This is a scheduled-maintenance decision, not a drop-in bump — budget a maintenance window and a post-deploy verification pass on the permission grid.
• Auditability and compliance requirements. Each save now runs as one warden operation, so every event a save dispatches carries the same $operation. If audit logging, "who changed what in one act" reporting, or SOC2-style change traceability is on the roadmap, this release makes that story defensible without custom instrumentation. Note the explicit scope: an operation opens no transaction and holds nothing back — grouping is for audit readability, not atomicity guarantees.
• Whether permission escalation is a real risk in our deployment. The fix closes a path where a grid save could keep an unconditional grant after warden refused to recreate a narrowed rule sitting in the trash — the cell then read as "every row" and the save reported success. For anyone running a swapped permission model with SoftDeletes, this was a silent privilege-widening bug. That is a security posture question, not a feature question.
• Support boundaries we communicate to stakeholders. Soft-deleted role/permission models remain unsupported, and a grant with an authority type but no key still counts as "everyone" on the permissions screen while warden treats it as nobody's. These are known, documented divergences — useful for scoping what we promise and what we explicitly exclude from a rollout.
• Build vs. buy for the permissions admin surface. Each release tightens the edge cases (trash interaction, role deletion semantics, inheritance) that a homegrown screen would have to rediscover. The accumulating correctness work is an argument for keeping this dependency rather than replacing it.

When to Consider This Package

• Adopt when you need an admin UI over roles, permissions, inheritance, and direct grants on Laravel, and you want per-save audit grouping without writing your own event correlation.
• Adopt with caution if your permission or role models use SoftDeletes — that path is explicitly unsupported, and one known case still surfaces warden's TrashedCatalogRow as an error page when granting from the grid a permission whose plain row is in the trash. Verify your schema against this before committing.
• Take the upgrade if you are on warden 3.0.x or 3.1 and rely on audit logs, or if any tenant uses a swapped permission model with soft deletes — the grid-widening fix alone justifies it.
• Look elsewhere or defer if you require transactional guarantees around a save (this release deliberately adds none), need soft-delete support as a first-class behavior, or depend on the authority-type-with-no-key rows that warden:clean --stranded will delete.
• Do not treat 3.5.0 as a cleanup release. The known-open items from 3.4.0 — the inspector's live region, overridden stylesheet rules, the pending review's date comparison, and two strict role-key comparisons — remain open. If any of those are on your accessibility or correctness checklist, they are still outstanding.

How to Pitch It (Stakeholders)

To executives: This is a minor version with a material fix. A save on the permissions screen could previously report success while leaving a rule broader than intended — effectively granting more access than the admin believed they had. That is now blocked and rolled back. The release also makes each admin save read as a single, coherent act in the audit log, which strengthens our change-traceability story. Cost is one planned upgrade with a one-time cleanup command; no feature work, no user-facing redesign.

To engineering: Bump to warden ^3.2; if you are coming from warden 3.0.0, run php artisan warden:clean --stranded once as part of the upgrade. Saves on the grid, an account's roles, a role's inheritance, and direct-grant flips or removals now share one $operation across all dispatched events, including EditRole::save() and CreateRole::create() wrapping the whole page save. Refusals from warden on a trashed narrowed rule now fail the save and roll back instead of being shrugged off. Role deletion dispatches RoleRetracted per holder, so the old "no trace afterwards" warning text was wrong and has been corrected in both languages. Open items from 3.4.0 are untouched, and soft-deleted role/permission models plus authority-type-with-no-key rows remain unsupported — plan around them, don't work around them.