Access Guard
composer require langsys/laravel-access-guard 
PHP 8.2+ Laravel 10 / 11 / 12 Entity-scoped role-based authorization for Laravel. Where spatie/laravel-permission gives users global roles, Access Guard scopes a role to an entity — a user is an admin of this organization and a viewer of that project — and treats API keys as first-class authorizable subjects alongside users.
It authorizes against interfaces you implement on your own models, so it works for any hierarchy (orgs, projects, teams, workspaces, tenants). No hard dependency on any other package; pairs naturally with API Keys.
The model
Section titled “The model”Authorization answers one question: may this subject perform this permission on this entity? A subject is either a user (with a role in the entity) or an API key (linked to the entity). Permissions are plain strings.
use Langsys\AccessGuard\Facades\AccessGuard;
AccessGuard::authorize('edit_projects', $project); // throws UnauthorizedException (403) if denied
if (AccessGuard::allows('view_projects', $project)) { /* ... */ }
// Keep only the entities the current subject may see:$visible = AccessGuard::filterByPermission('view_projects', $projects);In this package
Section titled “In this package” Installation Composer, migrations, and the optional config file. Wiring models AuthorizableByUser, GuardableResource, and the contracts you implement. Roles & permissions The bundled Role/Permission models and grantPermissions(). Subject resolution How authorize() picks a user, an API key, or a super admin. API keys Zero-config pairing with laravel-api-keys. Assigning roles HasRolesInEntities, direct permissions, and custom pivots. Wildcard permissions Optional segment wildcards like projects.*. Gate & policies Grant-only Gate integration, @can, and @hasrole. Route middleware access-guard:permission,parameter. Exceptions UnauthorizedException context and handler gotchas. Reference Cache, artisan commands, enums, events, and tests.