How do permissions and security work in Laravel Nova?

Laravel Nova is designed for authenticated administration, but installing it does not decide who should access each record or action. Security depends on explicit Laravel policies, careful field design, supported software and the way administrator accounts are operated.

Authentication establishes identity

Every administrator should use an individual account. Strong unique passwords and multi-factor authentication reduce avoidable account risk. Accounts belonging to former staff or suppliers should be removed promptly rather than shared or left dormant.

Policies decide what each person may do

Laravel policies can control viewing, creating, updating, deleting and restoring each resource. They can also enforce organisation or record-level boundaries. Hiding a navigation link is not sufficient if the server would still permit the request.

Limit fields as well as resources

A person may need access to a customer record without seeing every private field. Nova fields can be read-only, hidden or conditionally available. Collect and expose only information necessary for the user’s responsibility.

Protect powerful actions

Exports, bulk updates, impersonation and destructive tasks deserve tighter authorisation and clear confirmation. Background actions should validate the selected records again and report failures rather than assuming the interface made the request safe.

Maintain audit evidence

Important changes may need a record of who acted, what changed and when. Logs should support investigation without storing passwords, access tokens or unnecessary personal data. Retention should reflect business and legal requirements.

Secure the complete application

Nova relies on Laravel, PHP, packages, the database and hosting. Updates, backups, monitoring, rate limits and incident response remain essential. Restricting the `/nova` URL in robots.txt protects search visibility, not access security.

Read our guide on Laravel application security, or discuss a permission model with our Laravel Nova team.