---
title: "Checking access — Permissions for Laravel | Roundly"
description: "Check roles and effective permissions, list names and grants, eager-load for bulk checks, and query holders by role."
url: https://roundly-consulting.com/open-source/docs/permissions-for-laravel/checking-access
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Permissions for Laravel](https://roundly-consulting.com/open-source/docs/permissions-for-laravel.md)

# Checking access

Reads live on the model, not the facade — they use the relations you may have eager-loaded. The facade answers only catalog questions, such as Permissions::exists():

```php
$user->hasRole('administrator');                 // bool
$user->hasRole(['administrator', 'editor']);     // any of

$user->hasPermissionTo('auth.users.view');       // effective: direct or via a role

$user->getRoleNames();          // Collection<string>
$user->getPermissionNames();    // Collection<string> — direct grants only
$user->getDirectPermissions();  // direct grants only
$user->getAllPermissions();     // direct ∪ via-roles, de-duped — the JWT claim source
$user->getAllPermissions()->pluck('name');
```

- hasRole() — true when the model holds any of the given roles (a string, an enum, or an iterable of names, enums and Role models).
- hasPermissionTo() — on a holder, checks effective permissions: direct grants plus everything inherited through roles. On a Role, it checks the role’s own grants.
- getDirectPermissions() / getPermissionNames() — direct grants only.
- getAllPermissions() — direct ∪ via-roles, de-duplicated by id.

Checks never throw: an unknown role or permission name simply returns false.

## Eager loading

Checks read the loaded relations when they are present. Eager-load roles.permissions and permissions to check many holders without N+1 queries — the result is identical eager or lazy:

```php
$users = User::query()->with(['roles.permissions', 'permissions'])->get();

foreach ($users as $user) {
    $user->getAllPermissions(); // read from the loaded relations — no extra queries
}
```

## Permission claims for tokens

In an API service, getAllPermissions() is the natural source for a token’s permissions claim:

```php
$claims = [
    'roles' => $user->getRoleNames()->all(),
    'permissions' => $user->getAllPermissions()->pluck('name')->all(),
];
```

## Query scope

Filter holders by role with the role() scope — it matches models that hold any of the given roles:

```php
User::query()->role('administrator')->count();
User::query()->role(['administrator', 'editor'])->get();
```

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/permissions-for-laravel.md)