Bouncer

Bouncer is an elegant, framework-agnostic package for managing roles and abilities for any app built on Eloquent models. In Laravel it layers a fluent, expressive permissions API directly on top of the framework’s native Gate and Policy authorization system, so you keep using can/authorize while defining who may do what through roles and abilities stored in the database.

Bouncer supports assigning abilities directly to users or through roles, model-level and per-model-instance permissions, ownership constraints, wildcard abilities, forbidding abilities, multi-tenancy scopes, and optional caching for permission checks.

What You Get

• A fluent API for creating roles and abilities
• Direct-to-user or role-based ability assignment
• Model-level and per-instance permission granularity
• Ownership and constraint-based abilities
• Forbidding abilities that override grants
• Multi-tenancy scoping and optional permission caching
• Seamless integration with Laravel’s Gate and Policy system

Common Use Cases

• Adding role-based access control to a Laravel application
• Granting fine-grained, per-record permissions to users
• Scoping permissions per tenant in a multi-tenant SaaS
• Managing an admin panel’s roles and abilities dynamically

Under The Hood

Architecture - The public API is exposed through Bouncer.php and BouncerFacade.php, backed by a Clipboard/CachedClipboard that resolves a user’s abilities and registers them with Laravel’s Gate. Fluent operations (assign, allow, forbid, scope) are implemented as Conductors that build and persist the underlying Eloquent role/ability records under src/Database, while Constraints express ownership and attribute-based conditions. A BouncerServiceProvider wires everything into Laravel, and console commands under src/Console publish migrations and clean orphaned records. Tech Stack - PHP built on Laravel’s Eloquent, Auth, and Gate contracts, distributed under the MIT license; it also runs in non-Laravel apps that use Eloquent by manually constructing the container. Code Quality - A mature, well-tested codebase (600+ commits, 38 releases) with a substantial test suite run in CI, clear separation between conductors, constraints, and persistence, and defined contract interfaces. API Design - The API is a highlight: expressive, readable calls like Bouncer::allow($user)->to('edit', $post) and Bouncer::role()/Bouncer::ability() conductors make complex permission logic concise, and because checks flow through the native Gate, adopting Bouncer requires no change to existing can()/authorize() call sites.