Laravel developers introduce Valkyrie for role-based access control

A new role-based access control (RBAC) package, Valkyrie, has been released for the Laravel framework. The package provides a fluent API to manage roles and abilities, storing authorization rules directly in the database.

Key features of Valkyrie include a ‘forbids always win’ logic, where explicit prohibitions override any permissions. It also supports scoped grants, allowing permissions to be limited to specific models like teams or projects, and ownership grants that restrict abilities to records owned by the actor. The package is designed to be compatible with various multi-tenancy setups and includes a versioned cache system to manage invalidations during database transactions.

Separately, technical guidance has been identified regarding common Laravel authorization failures. These issues typically stem from policy discovery errors, improper use of gates versus policies, interface-based security misconceptions, authentication errors misdiagnosed as authorization issues, or the misuse of Sanctum token abilities.