How do Gates and Policies differ in Laravel authorization?

Short answer

Gates are defined for general actions unrelated to a specific model (such as accessing an admin dashboard), while Policies organize permissions around a model (such as PostPolicy).

Explanation

Gates work well for quick checks: Gate::define('access-admin', fn($user) => $user->isAdmin). For complete permissions on a model (view, update, delete, restore), a Policy provides a separate class with view, create, update, and delete methods. Check them with $user->can('update', $post) or @can in Blade.

Code example

class PostPolicy {
    public function update(User $user, Post $post): bool {
        return $user->id === $post->user_id;
    }
}
// Use: $this->authorize('update', $post);

Common mistakes

• Writing authorization conditions manually in Controllers and repeating them in every route.

Follow-up questions

• How does Blade protect against XSS, and what is the difference between {{ $data }} and {!! $data !!}?

Sources

• Laravel docs — Authorization