Acl Sonata Admin Extension Bundle Laravel Package

Product Decisions This Supports

• Feature scoping: row-level visibility in admin panels. This bundle answers a very concrete product question: "should a regional manager / tenant admin / delegated operator only see the records they are permitted to touch?" It adds ACL-driven filtering to SonataAdmin list views, so it directly supports decisions about whether to ship permission-scoped back-office experiences rather than all-or-nothing admin access.
• Build vs. buy for a narrow admin requirement. If the product already runs on SonataAdminBundle plus Symfony's ACL component, this package is a candidate to satisfy the "filter the datagrid by ACL" requirement in days instead of a custom sprint. The decision is not "is this a good package" but "is this cheaper than the 1–2 weeks of engineering to replicate its query filtering, and can we own it when it breaks?"
• Delegated administration as a market/segment enabler. Row-level filtering is the prerequisite for selling into customers who need sub-organizational admin roles (regional operators, franchise owners, tenant-level support staff). Adopting this bundle is a cheap way to validate that demand before investing in a first-class permissions model.
• Roadmap triage and technical debt acknowledgment. With a last release in 2017, 45 stars, and zero dependents, the realistic product decision this supports is a stopgap: use it to unblock a specific customer or compliance requirement on a legacy stack, and explicitly schedule the migration to Symfony voters + custom datagrid filters when the admin surface is next reworked.
• Prioritization signal against modern alternatives. Its low opportunity score is itself a decision input — it tells you not to build a roadmap dependency on top of it, and not to expect community fixes, documentation, or Symfony-version compatibility work from anyone but your own team.

When to Consider This Package

Consider it when all of the following are true:

• The application is already on SonataAdminBundle, and ACLs are already configured on the relevant domain objects — this bundle is glue, not an ACL implementation, and delivers nothing if ACLs are not in place.
• The requirement is specifically list/datagrid filtering, i.e., "admins must not see objects they lack VIEW rights to," as opposed to object-level checks on edit forms or API responses.
• You are on an older Symfony/PHP line compatible with the bundle's 2017-era constraints, or you are prepared to patch and vendor it.
• You can accept maintenance ownership: MIT license means forking is legally trivial, and you should assume you will fork.
• The alternative — writing a custom Sonata datagrid query filter against the ACL service — would cost more than the integration and your team lacks Sonata internals expertise.

Look elsewhere when:

• The project is new or being modernized. Use Symfony's voter/security system with custom query scoping, or a maintained admin tool such as EasyAdmin, rather than adopting both SonataAdmin and this abandoned extension.
• You need actively maintained dependencies — no releases since March 2017 and zero dependents means no ecosystem pressure to fix security or compatibility issues.
• You need capabilities beyond list filtering: audit trails, permission delegation UIs, explainability of why a record is hidden, or performance-tuned filtering at scale.
• The permission model is not ACL-shaped (e.g., attribute-based rules, ownership columns, tenant IDs). A purpose-built query filter keyed on your own columns will be simpler and faster than retrofitting Symfony ACL.
• Your security posture requires supported software with a documented CVE response path.

How to Pitch It (Stakeholders)

• To executives: "We have a back-office requirement that certain administrators only see the subset of records they're authorized for. There's an existing open-source component that does exactly this for our current admin framework, so we can likely meet the requirement without a custom build. The catch: it hasn't been updated since 2017 and no one else uses it publicly, so we'd be adopting it as our own code — small effort now, small ongoing maintenance cost, and it should be treated as a short-term bridge rather than a foundation. Recommend: pilot it against one customer's permission model, then decide whether to fund a proper permissions rework next cycle."
• To engineering: "This is a thin Symfony bundle that plugs ACL checks into SonataAdmin's datagrid query — it saves us writing that filter ourselves. It's MIT, it's unmaintained, and it's pinned to legacy Symfony. Proposal: vendor or fork it, pin the version, add a test that proves unauthorized rows never appear in the list query, and log it as technical debt with a migration ticket to voters + custom filters."
• Framing the trade-off in one line: low integration cost and zero license cost, in exchange for taking ownership of an orphaned dependency — acceptable only where the admin stack is already legacy.