PHP RBAC Authorization

Preferred RBAC Stack

Use RBAC as the standard model for coarse application authorization.

• For compatible PHP applications, prefer laminas/laminas-permissions-rbac as the RBAC engine.
• In a Mezzio application that uses Mezzio Authorization, prefer mezzio/mezzio-authorization-rbac as the integration adapter.
• Do not build a custom role graph, permission inheritance engine, or RBAC evaluator when the Laminas components satisfy the requirement.
• Use another authorization model only when an explicit project requirement cannot be represented safely by RBAC. Record that decision in the project's architecture documentation.
• Keep Laminas and Mezzio concrete types in infrastructure adapters, factories, middleware, and configuration.
• Expose an application-owned AuthorizationService, Permission enum, CurrentUser, and authorization attributes to the rest of the application.

For example, keep permission vocabulary and the authorization port independent of Laminas: