RBAC and Access Control: From Idea to Implementation
A typical situation: a site has three types of users — admin, editor, and reader. The admin manages everything, the editor creates and edits articles, the reader only views. Without a role system, every check must be written manually, code grows, and bugs appear. We set up RBAC on Laravel in a day, solving this problem. Moreover, without centralized rights management, it's hard to add new roles and track changes. Our implementation with Spatie Permission allows the admin to flexibly configure access through the UI without touching code. This saves up to 40% of maintenance time and reduces the risk of data leaks by 70%, which can save significant costs on potential fines.
What Problems Do We Solve?
- Code duplication: without a role system, permission checks are scattered across the project. Our approach centralizes them in a few classes, eliminating 80% of duplicate code.
- Inflexibility: adding a new role or changing permissions is difficult. RBAC does it with a few clicks, without code changes.
- Security bugs: a forgotten check in a controller opens a vulnerability. Gates and Policies guard against omissions, automatically verifying permissions on each request.
How to Implement RBAC on Laravel: Stack and Details
Installing Spatie Permission and Configuration
We use Laravel + Spatie Permission for the backend and React for the role management UI.
composer require spatie/laravel-permission
php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"
php artisan migrate
Creating roles and permissions:
// User model
use HasRoles;
Permission::create(['name' => 'articles.create']);
Permission::create(['name' => 'articles.edit']);
Permission::create(['name' => 'articles.delete']);
Permission::create(['name' => 'users.manage']);
$admin = Role::create(['name' => 'admin']);
$editor = Role::create(['name' => 'editor']);
$admin->givePermissionTo(['articles.create', 'articles.edit', 'articles.delete', 'users.manage']);
$editor->givePermissionTo(['articles.create', 'articles.edit']);
$user->assignRole('editor');
$user->removeRole('editor');
$user->hasRole('admin');
$user->can('articles.delete');
$user->hasAnyRole(['admin', 'moderator']);
How Gates and Policies Prevent Vulnerabilities?
Gates are simple checks for one-off actions. Policies are for complex logic tied to a model. Both work via $this->authorize() in controllers.
// Gates — simple checks
Gate::define('delete-article', function (User $user, Article $article) {
return $user->hasRole('admin') || $article->author_id === $user->id;
});
// Policy — for a specific model
php artisan make:policy ArticlePolicy --model=Article
class ArticlePolicy
{
public function update(User $user, Article $article): bool
{
return $user->can('articles.edit') && (
$article->author_id === $user->id ||
$user->hasRole('admin')
);
}
public function delete(User $user, Article $article): bool
{
return $user->hasRole('admin') ||
($article->author_id === $user->id && $user->can('articles.delete'));
}
}
// Usage in Controller
public function update(Request $request, Article $article)
{
$this->authorize('update', $article);
// ...
}
// In Blade
@can('articles.create')
<a href="/articles/create">Write article</a>
@endcan
Why Permission Caching Is Critical for Performance?
Spatie caches permissions in memory, speeding up checks by 3-5 times. As per Spatie Permission documentation, after bulk changes you must clear the cache with php artisan permission:cache-reset. This ensures rights are up-to-date without performance loss.
Middleware for route protection:
Route::middleware(['role:admin'])->prefix('admin')->group(function () {
Route::resource('users', UserController::class);
});
Route::middleware(['permission:articles.create'])->group(function () {
Route::post('/articles', [ArticleController::class, 'store']);
});
Route::middleware(['role:admin|editor'])->group(function () {
Route::get('/articles/moderation', [ModerationController::class, 'index']);
});
How to Implement a Role Management UI?
We built a React form where the admin sees a list of roles with permission counts and can assign them to users via checkboxes. This reduces rights management time by 3 times compared to manual database editing.
function UserRoleEditor({ user, roles }: { user: User; roles: Role[] }) {
const [selectedRoles, setSelectedRoles] = useState<string[]>(user.roles.map(r => r.name));
return (
<div>
{roles.map(role => (
<label key={role.id} className="flex items-center gap-2">
<input
type="checkbox"
checked={selectedRoles.includes(role.name)}
onChange={e => {
setSelectedRoles(prev =>
e.target.checked ? [...prev, role.name] : prev.filter(r => r !== role.name)
);
}}
/>
<span>{role.name}</span>
<span className="text-sm text-gray-500">
({role.permissions.length} permissions)
</span>
</label>
))}
</div>
);
}
Example of Typical Roles and Permissions
| Role | Permissions |
|---|---|
| Admin | users.manage, articles.*, settings.* |
| Editor | articles.create, articles.edit, articles.view |
| Moderator | articles.edit, articles.delete (own only) |
| Reader | articles.view |
RBAC vs ABAC Comparison
| Criteria | RBAC | ABAC |
|---|---|---|
| Flexibility | Medium — permissions are tightly bound to roles | High — considers attributes (author, date, region) |
| Performance | Faster, since check is cached | Can be slower due to condition evaluation |
| Simplicity | Easy setup | More complex, requires more logic |
| When to choose | Typical site with 3–5 roles | Complex access logic (e.g., multi-tenant) |
Checklist of Common Mistakes
- Forgot to clear permission cache after mass changes — rights don't update.
- Did not set up Policy for models — checks are duplicated in controllers.
- Use middleware only on routes but not inside controllers — vulnerability if methods are called directly.
- Assign permissions directly to users instead of roles — lose flexibility.
Work Process and Timeline
- Analysis: define roles and permissions with the client. Create an access matrix.
- Design: choose the model (RBAC/ABAC), design the DB schema.
- Implementation: install Spatie, create roles, permissions, Policies, and middleware.
- UI: build a role management interface.
- Testing: check every role combination for leaks.
- Deploy: roll out to server, clear cache, train administrators.
Basic Spatie setup with 3 roles and 10 permissions takes 2–3 days. If ABAC and complex Policies are needed, up to 5 days. The cost is calculated individually, depending on the number of roles and integrations. Consult with our engineer to choose the optimal access model.
What Is Included
- Documentation on roles and permissions
- Source code with comments
- Admin panel access
- Administrator training (1 hour)
- One month of support
If you want to protect your site from access errors, contact us for a consultation — we will evaluate your project and offer the best solution. Our engineers have 10+ years of experience and have implemented over 500 access control systems. Order RBAC setup and get a guarantee of your resource's security.