# Build Laravel authorization that preserves record ownership

The policy receives the authenticated User and the requested Order. It grants an update only when their IDs match. A controller that looks up an order successfully still needs authorization before changing it.

## Implement the requirement

Save this as `app/Policies/OrderPolicy.php`:

```php
<?php

namespace App\Policies;

use App\Models\Order;
use App\Models\User;

class OrderPolicy
{
    public function update(User $user, Order $order): bool
    {
        return (int) $user->id === (int) $order->user_id;
    }
}
```

The requirement is adapted from Perch’s public [order-service example](https://github.com/lakeday-org/perch/blob/4af67af46d76ac99398d61c7ad0a45441760d4dc/test/fixtures/order-service/auth.py) at commit `4af67af`. The Laravel implementation below is an illustrative adaptation, not a claim about that source project’s framework.

## Create the Laravel project

```sh
composer create-project laravel/laravel checked-laravel '^12.0'
cd checked-laravel
php artisan make:model Order
php artisan make:policy OrderPolicy --model=Order
git init -b tutorial
```

Laravel conventionally discovers `OrderPolicy` for `Order` in these directories. An authenticated update action should load the order, call `Gate::authorize('update', $order)`, then apply validated fields. Keep that action behind your configured authentication middleware. This guide tests the policy in memory, so no orders table or login scaffold is required for the test.

Start the development server with `php artisan serve`. Follow the [Laravel setup documentation](https://laravel.com/docs/12.x/installation) for platform prerequisites. The framework API used here is documented in [the official reference](https://laravel.com/docs/12.x/authorization).

## Test the broken and corrected behavior

Save this as `tests/Unit/OrderPolicyTest.php`:

```php
<?php

namespace Tests\Unit;

use App\Models\Order;
use App\Models\User;
use App\Policies\OrderPolicy;
use Tests\TestCase;

class OrderPolicyTest extends TestCase
{
    public function test_only_owner_can_update(): void
    {
        $owner = new User();
        $owner->id = 10;
        $other = new User();
        $other->id = 11;
        $order = new Order();
        $order->user_id = 10;
        $policy = new OrderPolicy();
        $this->assertTrue($policy->update($owner, $order));
        $this->assertFalse($policy->update($other, $order));
    }
}
```

Run `php artisan test --filter=OrderPolicyTest`. Then make this deliberate regression: replace `return (int) $user->id === (int) $order->user_id;` with `return true;`. The boundary test should fail. Restore the original before continuing.

## Save the requirement as a Perch rule

Perch is an open-source semantic linter powered by SystemOne decision models. Save the following rule in .perch/rules/perch-guide-laravel-intro.yaml at the repository root, keeping your existing perch.yaml:

```yaml
- name: order-owner-required
  where: "app/Policies/OrderPolicy.php"
  ensure: >-
    The update policy grants access only when the authenticated user id equals the order user_id. It must not return true for a different user.
```

Install the CLI and sign in, then check the working file:

```sh
npm install -g @lakeday/perch
perch login
perch check app/Policies/OrderPolicy.php --rules order-owner-required --json
```

Use Node 22 or newer. `perch login` opens the authentication workflow. `perch check` reads the file currently on disk, so the agent can check an uncommitted edit. A rule finding exits 3; exits 1 and 2 mean the check did not complete. Read the JSON and the code before deciding what to change.

## Captured Perch check

On October 14, 2026, we ran the rule above through Perch using jev-latest on the deliberately broken and corrected files.

| Control | Command exit | Outcome |
| --- | --- | --- |
| Broken implementation | 3 | Rule finding reported |
| Corrected implementation | 0 | No rule finding reported |

The rule distinguished these two controls in this captured run. Fresh judgments can vary. [Captured command output](/intro/capture.json) and the [broken and corrected source](/intro/examples.json) are available for inspection.

## Install the rule pack and configure your agent

[Download this rule pack ZIP](/intro/rule-pack.zip) · [Download the YAML rules](/intro/rules.yaml) · [Agent task](/intro/agent-task.txt). The pack contains the rule, its example paths and the repair/recheck instructions. Review the `where` selector before using it in an existing project. Keep your root `perch.yaml`; install this rule as a separate file under `.perch/rules/`.

1. Install Perch using Node 22 or newer and sign in once:

```sh
npm install -g @lakeday/perch
perch login
```

2. Download the pack, inspect it, and extract it from your repository root. The extraction preserves any existing files:

```sh
curl -fL 'https://reporules.fyi/laravel/intro/rule-pack.zip' -o 'perch-guide-laravel-intro.zip'
unzip -n 'perch-guide-laravel-intro.zip'
```

The installed rule is `.perch/rules/perch-guide-laravel-intro.yaml`. Its selector matches `app/Policies/OrderPolicy.php` in this example; adapt the selector to your application file before checking an existing project.

3. Configure the coding agent you use. Run one of these commands:

Claude Code:

```sh
perch setup claude-code
```

Codex:

```sh
perch setup codex
```

Cursor:

```sh
perch setup cursor
```

Pi:

```sh
perch setup pi
```

4. Ask the agent to edit the implementation and check the saved requirement:

> Use the installed Perch skill while editing app/Policies/OrderPolicy.php. Preserve order-owner-required. Run perch check app/Policies/OrderPolicy.php --rules order-owner-required --json after the edit. Read each finding and the affected code, fix the implementation, and run the identical check again after the fix. Keep the rule and regression tests intact. Run the application's relevant regression tests and report the commands and actual results. Exit 3 means a rule finding; exit 1 or 2 means the check did not complete. Report an unavailable or incomplete check as blocked. Do not claim the application tests ran if only the Perch check ran.

5. After repairing a finding, run the same check again and inspect the result:

```sh
perch check app/Policies/OrderPolicy.php --rules order-owner-required --json
```

Commit the downloaded rule and the installed agent configuration with your application. The rule file adds no guarantee of correctness; keep the regression tests from this guide.

## Keep the checks within their scope

The policy must be invoked by every relevant controller or job. Test the HTTP action separately for unauthenticated callers, missing records, and cross-user requests. A correct policy that is never called cannot protect the application.

Fresh model judgments can vary. Unchanged requests can reuse cached answers. A passing rule check does not prove the application correct; keep the executable test as a separate check. Relevant source code is sent to the configured analysis service.

Published by Perch / Verglas LLC. Framework names identify the software used; this guide is not an official framework publication.