Repository navigation
Capability Review
Reviewed 9 November 2026 under parent issue #1 and capability-review issue #5. Current release snapshots: Spatie laravel-permission 8.5.0, Bouncer v1.0.4, Laratrust 8.5.6. The review examines official public documentation and Composer metadata, not competitor implementation internals, benchmarks or a security audit. No competitor is a dependency and no implementation code is copied.
Access covers the shared role-based authorization core in the requested version-one scope: named definitions, multiple user roles, direct permissions, permissions inherited from roles, independent revocation, role permission-set changes, effective-permission inspection, and native Laravel Gate/policy integration through explicit host rules.
It does not claim complete feature parity or overall superiority. The other packages offer broader convenience APIs and extensibility. Some differences are deliberate owner requirements: no implicit current-team state, persistent permission cache, automatic Gate hook, administration UI, tenancy framework or explicit deny system. We prioritize a small predictable package over reproducing every surface of three mature products.
Spatie documents bulk assignment/syncing, any/all/exact role checks, direct-versus-inherited permission inspection, reverse role-to-model assignment, and user query scopes. Access provides the core single-target assignment/check operations and role permission-set replacement; bulk user synchronization, query scopes, any/all convenience methods and permission-provenance inspection are not built-in in this version. These are genuine API breadth gaps rather than claims of equal convenience. Role/permission API, query scopes.
Spatie's teams documentation uses an active team ID and describes clearing loaded relations when switching it. Access passes a team model or name explicitly on each operation and enforces its own independent membership. Its global-grant inheritance rule is a fixed contract, not a drop-in reproduction of Spatie teams. Spatie teams.
Spatie provides permission caching with automatic invalidation through supported APIs and manual reset paths for other changes. Access starts with fresh database reads and no permission cache, simplifying its revocation and worker-state contract at the cost of more queries. No relative speed or correctness advantage is asserted without measurement. Spatie caching.
Spatie also supports multi-guard contexts, enums, wildcard permissions, middleware/route conveniences and optional assignment events. Access uses one configured UUID authenticatable, exact string names and host-owned policies. Hosts can pass an enum's string value, but Access does not advertise direct enum input. Wildcards, custom authorization middleware and package assignment events remain absent. Guards, enums, wildcards, middleware, events.
Spatie supports UUID/ULID customization; Access ships UUIDv7 definitions and UUID-compatible user foreign keys as its standard schema. UUID support itself is not unique to Access. Spatie UUID guidance.
Bouncer documents direct/role abilities, model-type and model-instance restrictions, ownership rules, explicit forbidden abilities, broad ability grants, request/cross-request caching, scoped multi-tenancy and automatic consultation by Laravel's Gate. It can create missing roles/abilities during grants and supplies role query helpers. Access intentionally requires existing definitions, uses native host policies for resource ownership, and provides no deny rules, model-specific grant schema, broad wildcard grant or tenancy engine. Its explicit membership group is a different abstraction from Bouncer's scope. Bouncer's breadth is useful for applications needing those policies in the package; it is not matched by Access v1. Bouncer public API and scope documentation.
Laratrust provides direct and role permissions, multiple user models, middleware/guards, caching, events and an administration panel. Its public API includes bulk assignment/syncing, alternate check spellings, multiple-item checks and wildcard matching. Access deliberately uses a single explicit mutation vocabulary rather than alternate spellings. Multiple-user support, UI, middleware and wildcard/event surfaces are not implemented here. Laratrust overview, roles and permissions, events.
Laratrust already accepts explicit team parameters, so this alone cannot distinguish Access. Its documented teams_strict_check option changes whether a check without a team can consider assignments from teams; its team relations are described through assigned roles. Access fixes the no-team meaning to global grants only and has separate active membership, with membership-dependent grants and cascading cleanup. This review does not infer that a competitor lacks every possible membership integration merely because it is not part of the reviewed API. Laratrust teams, querying relationships.
- One preferred command vocabulary—
assignRole,assignPermission,assignTeam—paired withrevokeRole,revokePermissionandrevokeTeam; no compatibility aliases. Naming decision. - Team names or models are explicit on every operation; application-wide definitions, exact-team assignments and global inheritance have one documented meaning.
- Membership exists independently of permissions. Removing it cascades scoped grants, and rejoining never silently restores old assignments.
- UUIDv7 defaults, UUID host relationships, non-null generated global-scope uniqueness, and membership foreign keys are supplied rather than left solely to application conventions.
- Independent-process tests exercise duplicate assignments and membership races on SQLite and MariaDB; role changes and revocations are checked using reused objects without a cache reset. Verification evidence.
- Host policies remain authoritative because Access installs no automatic Gate callback. Actor authorization stays explicit in management integrations. Authorized integration.
These are verified Access properties and design choices. No corresponding vulnerability, performance deficiency or lack of testing is alleged in another package.
The inspected release Composer metadata declares Laravel 12/13 compatibility for all three packages. Laratrust's README compatibility table does not list Laravel 13, while its 8.5.6 Composer constraint does; the package metadata is the concrete dependency declaration. We did not execute competitor test matrices and do not treat those declarations as proof equivalent to Access's recorded runs. Spatie metadata, Bouncer metadata, Laratrust metadata.
The owner-approved explicit command vocabulary and named-team syntax were implemented as review follow-through in issues #6 and #7. Broader parity would require additional scoped work. If selected later, useful bounded candidates are exact-scope atomic syncRoles/syncPermissions, any/all check helpers, direct-versus-inherited inspection and user query scopes. They must preserve membership, global/team isolation and transactional replacement semantics; they are not silently claimed as available today. Role inheritance, explicit deny rules, tenancy and UI remain outside the original version-one boundary.
Copyright © 2026 Moztopia · Source · Licensing status · Security