A gate is a simple authorization rule. Gates are useful when permission logic does not belong to a particular model, such as checking whether a user can access an administration dashboard.

In modern Laravel applications, define gates in AppServiceProvider.php or an appropriate authorization provider.

Example:

<?php

namespace App\Providers;

use App\Models\User;
use Illuminate\Support\Facades\Gate;
use Illuminate\Support\ServiceProvider;

class AppServiceProvider extends ServiceProvider
{
    public function boot(): void
    {
        Gate::define('access-admin', function (User $user) {
            return $user->role === 'admin';
        });
    }
}

This example assumes your users table contains a role column.

Check the permission in a controller:

use Illuminate\Support\Facades\Gate;

if (Gate::allows('access-admin')) {
    // User is authorized.
} else {
    abort(403, 'Unauthorized action.');
}

A 403 response means the user is not permitted to perform the requested action.

If your application has roles such as admin, teacher, and student, custom middleware can check a user's role.

Create the middleware:

php artisan make:middleware RoleMiddleware

Open app/Http/Middleware/RoleMiddleware.php.

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class RoleMiddleware
{
    public function handle(
        Request $request,
        Closure $next,
        string $role
    ): Response {
        $user = $request->user();

        if (! $user || $user->role !== $role) {
            abort(403, 'You are not authorized to access this page.');
        }

        return $next($request);
    }
}

This example assumes the authenticated user has a role column.

Register the middleware alias:

In Laravel 11 and later, add the alias inside the existing withMiddleware() configuration in bootstrap/app.php:

use App\Http\Middleware\RoleMiddleware;
use Illuminate\Foundation\Configuration\Middleware;

->withMiddleware(function (Middleware $middleware): void {
    $middleware->alias([
        'role' => RoleMiddleware::class,
    ]);
})

Merge this alias into your existing configuration rather than creating a second withMiddleware() call.

Use the middleware on a route:

Route::get('/admin', function () {
    return view('admin.dashboard');
})->middleware(['auth', 'role:admin']);

For Laravel 10, register the alias in the $middlewareAliases array in app/Http/Kernel.php.