Laravel Warrant

Row-level permissions & authorization for Laravel — one rule, compiled straight to SQL.

Read the documentation → laravel-warrant.dev

[!WARNING] Laravel Warrant is in beta and still being tested. It's usable, but the API may change between releases — pin your version and check the changelog before upgrading. Please report any issues you run into.

[!NOTE] Not an official Laravel package. Laravel Warrant is an independent, open-source project. It is not affiliated with, maintained by, or endorsed by the Laravel team.

Schema-based authorization for Laravel that compiles a small, human-readable rule language directly into SQL — so "what can this user do?" and "which rows can this user touch?" are answered by the database in a single query, not by loading records into memory.

That block is a real, complete Warrant rule. Warrant turns it into a WHERE clause.

Installation

The service provider auto-registers. Publish the config to edit it in place:

Requirements: PHP 8.2+, Laravel 11 or 12. The SQL Warrant generates is supported on PostgreSQL, MySQL/MariaDB, and SQLite.

Documentation

Full docs live at laravel-warrant.dev:

• Quick start · Core concepts · vs. spatie/laravel-permission
• Schemas · Conditions · Check-time context
• The rule language · Building rules · Providing rules
• Checking access · Reachability · Route middleware · Denial messages
• How it compiles to SQL · Testing
• API reference: Checking · Schema · Rule building · Middleware · Errors · Cheat sheet

Why Warrant

• One source of truth. The same rule set answers a single check, filters a list, and reports the per-row ability list — no permission logic duplicated between a policy and a query.
• Compiles to SQL. Rules never run in PHP or pull your models into memory; they become a WHERE clause the database evaluates.
• Rules are data. Store them in the database, generate them from a GUI, or hard-code them — you decide where they come from and change them without touching app code.
• Readable language. Rules are written in a small if … they can/cannot … language that non-authors can follow.
• Integrates with Laravel's Gate. $user->can(), @can, Gate::authorize, and the can: route middleware resolve Warrant abilities, while abilities no schema declares fall through to your existing policies.

See Why Warrant for the full rationale and a comparison with the policy/query approach.

A quick example

1. The model uses the trait and names its schema:

2. The schema declares the vocabulary — abilities and conditions:

3. The resolver hands rules (as data) to Warrant for the current user:

The rules themselves are just text:

4. Register the resolver and schema in config/warrant.php:

5. Check access — every call is a single SQL query:

The Quick start walks through this end to end.

License

Laravel Warrant is open-source software licensed under the MIT license.