labrodev-authorizationlisted

# Authorization: Policies, #[UsePolicy], #[Authorize] Part of the Labrodev playbook. **The law for this component lives in the always-on `labrodev-authorization` guideline** (musts, must-nots); the per-file checklist is `rules/policies.md`. This skill holds the craft: anatomy, canonical templates, and edge cases. Authorization is one cluster with three pieces that must always be wired together: 1. **Policy** — `final class {Model}Policy` in `Core/Domain/{Domain}/Policies/`, answering "may this user perform this action on this object?" in business terms. 2. **Model wiring** — `#[UsePolicy({Model}Policy::class)]` attribute on the model class. 3. **Controller wiring** — class-level `#[Authorize(...)]` attribute on every invokable controller. ## The constant contract (critical) The permission constant's **value** is the string the Gate uses to find the policy method: ```php public const string PERMISSION_VIEW = 'view'; // resolves to view() public const string PERMISSION_UPDATE = 'update'; // resolves to update() ``` `#[Authorize(BookingPolicy::PERMISSION_UPDATE, 'booking')]` only works because `'update'` is a method on `BookingPolicy`. Two distinct string universes exist and must never be mixed: | String | Universe | Where it lives | |---|---|---| | `'view'`, `'update'` | Gate ability = policy method name | Constant values; `#[Authorize]` arguments | | `'booking.bookings.view'` | Dotted RBAC permission key (e.g. spatie/laravel-permission) | **Inside** method bodies o