bouncer VS laravel-permission

Bouncer on the other hand supports scoped permission assignments where the assigned permission applies to a specific model only.

That'd be great honestly, but I haven't found anything similar yet. I took a look at Bouncer but it doesn't seem to solve the problem either, just resource-based authorization too.

As well as using Spatie's Laravel Permission package, there are other packages that can be used to add roles and permissions to your application. For example, you could use Bouncer or Laratrust.

There are a few open source Laravel packages for managing roles and permissions. See https://github.com/spatie/laravel-permission or https://github.com/JosephSilber/bouncer.

In this tutorial, you'll learn how to implement RBAC in Laravel using Bouncer. Bouncer is a PHP package that lets you add roles and abilities to your Eloquent models.

I only have experience with Bouncer but it has worked well for me. As a basic hypothetical scenario, you can create different roles and abilities such as:

Another option is bouncer https://github.com/JosephSilber/bouncer

✅ Use FilamentUser to control access to the admin panel ✅ Use Laravel policies for clean, scalable access control ✅ For role-based systems, consider Filament Shield Plugin or Spatie Laravel Permission (my favorites) ✅ Mind the guards, soft deletes, and policy naming

Spatie Laravel Permission for roles & permissions

User management out of the box — powered by Spatie Laravel Permission, with roles, permissions, and policies pre-seeded.

When you're managing role-based access control (RBAC) in a Laravel app using the excellent Spatie Laravel Permission, you might wonder:

Package Link: Spatie Permission

For example, let's take look at the metrics for Spatie's Laravel Permission package at the time of this writing:

I am not sure how Passport would be used for handling permissions, Passport is for authentication. I would recommend using Laravel Permission to handle your requirements. You can assign roles to users to scope out general permissions but ultimately the permissions are what should be used to limit functionality.

If I remember correctly Spatie's permissions package allows for logic like "let this specific user edit models of this type" but does not allow for logic like "let this specific user edit only that specific model".

Despite this I pointed in the conversation above a super interesting point made by the guys at Spatie making the Laravel permissions package, where they recommend to encapsulate the authorization logic inside policies, and it is a great way to keep things clean, but in this case its not straightforward to do so, at least not if we follow the pure "Laravel-way" of doing things.