Laratrust keeps its install steps in a separate docs site, and its version table decides which branch you read

The Laravel version you run decides which Laratrust major you install

The compatibility table is the first thing on the front page, and it is the most useful piece of it. Laravel 10.x, 11.x and 12.x map to Laratrust 8.x. Laravel 9.x and 10.x map to 7.x. Laravel 8.x, 7.x and 6.x all map to 6.x. Laravel 5.6 to 5.8 maps to 5.2, Laravel 5.3 to 5.5 maps to 5.1, and Laravel 5.0 to 5.2 maps to 4.0, which is linked to a tree in the GitHub repository and not to a docs site.

Laravel 10.x appears in two rows, for 8.x and for 7.x, so an app on Laravel 10 has two supported majors to choose from. Pick 8.x for a new install, since it is the line that also covers 11 and 12.

The table stops at Laravel 12. A Laravel version newer than the ones listed has no row, and the front page says nothing about it, so check the documentation site and the releases before upgrading the framework.

Each row links to its own documentation version at laratrust.santigarcor.me/docs. Reading the wrong version is the easiest mistake with this package, because configuration keys and commands can differ between majors.

Installation, configuration and usage are all on the documentation site

The front page contains no install command, no config file excerpt and no code sample. Its Installation, Configuration and Usage section is a single sentence that sends you to the documentation at laratrust.santigarcor.me.

That is a deliberate split, and it has a consequence for anyone evaluating the package from GitHub alone. You cannot see how a role is created, how a permission is checked or what the migration looks like without leaving the repository.

What the repository does contain is a docs folder, a config folder, a stubs folder, a routes folder and a resources folder. The docs folder holds the source of the documentation site, so the same pages are available in the tree for the current branch. For the exact steps, open the docs page that matches your Laratrust major from the table above.

Roles and permissions can both be attached to users, and permissions to roles

The feature list is where the model of the package shows. Multiple roles and permissions can be assigned to users. Multiple permissions can be assigned to roles. Both can be verified.

The difference between a role and a permission follows from that. In Laratrust a role is a named group you give to a user, and a permission is a finer unit that you can give to a role or directly to a user. The front page does not define the words beyond that, so the exact semantics of checking a permission through a role are a matter for the docs.

Multiple user models are supported, which matters for apps that have more than one kind of account, for example staff and customers, each with its own table. Verification covers both roles and permissions, so a check can ask about either.

The list also names Laravel gates and policies, which means the package is meant to sit beside the framework's own authorization layer and not to replace it.

Teams scope roles and permissions to a group, and the front page stops at one line about it

Teams are listed as a feature: multiple roles and permissions can be added to users within teams. A user can therefore hold a role in one team and a different role, or none, in another.

The front page gives no detail on how a team is stored, how it is passed to a check or whether teams are switched on by default. Those answers sit in the docs for your major version.

If your application is a single organization with one set of roles, teams are extra surface you can leave alone. If it hosts several tenants that each need an admin role of their own, this is the feature to read about first, and it is worth confirming in the docs that your Laratrust major version supports it the way you need before building on it.

Caching, events and guards are listed, and their settings are not on the front page

Three more features are named in one line each. Roles and permissions caching is supported. Events fire when roles and permissions are added, removed or synced. The middleware can work with multiple guards.

Caching is the one to think about early. A cached role set means a change made in the database is not necessarily seen by a running request until the cache is refreshed, and the front page does not describe how or when the cache is cleared. Listen to the add, remove and sync events if other parts of the app have to react to a change in access.

Multiple guards matter for apps that mix, for example, a web guard and an API guard. The front page lists the capability without naming the config keys, so those keys are in the config folder and the docs.

A simple administration panel for roles and permissions is also part of the package. The word simple is the project's own, and it suggests a basic screen for managing the two lists, not a full access-control console.

The package.json in the repository belongs to the docs site, not to Laratrust

A package.json sits at the root, and it can mislead. Its name is laratrust and its version is 5.1.0, but the description reads Laratrust Docs. It lists vuepress 0.14.4, laravel-mix 5.0.4 and tailwindcss 1.4.2 as dev dependencies, with scripts named docs:dev and docs:build.

Those scripts run vuepress with NODE_OPTIONS=--openssl-legacy-provider, which is a flag needed for the old webpack under that vuepress version on newer Node releases. So this file builds the documentation, and it has nothing to do with installing the PHP package. The PHP side is described by composer.json, which sits beside it, and the 5.1.0 number does not track the 8.5.6 package release.

Contributors who want to work on the docs will need Node and an old toolchain. The code itself is checked by phpunit.xml, a .php-cs-fixer.php config and a .styleci.yml.

Releases are patch fixes, with a gap of nearly eight months before 8.5.6

The repository is not archived and was last pushed to on 2026-10-22. The recent releases are 8.5.4 on 2026-02-23, 8.5.5 on 2026-03-06 and 8.5.6 on 2026-10-22. All three are patch versions in the 8.5 line, so the visible history is maintenance, not a new feature line.

The gap between 8.5.5 and 8.5.6 is a little over seven months. The front page does not say why, and nothing in the repository front page promises a release schedule. A reader who needs a fix on a specific date should read CHANGELOG.md, which is in the repository root, to see what each patch changed.

The license is MIT. Contributions are welcome through the GitHub issues page and pull requests, and the project accepts sponsorship through GitHub Sponsors.

Editorial conclusion

Use Laratrust if a Laravel 10, 11 or 12 app needs roles and permissions with optional teams, caching and a small admin panel, and you are fine reading a separate documentation site for the install steps. Skip it if you need setup instructions inside the repository, since the front page has none. Before installing, match your Laravel version to the row of the compatibility table and open the documentation for that Laratrust major version, not the latest one.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. README
4. Releases
5. santigarcor/laratrust on GitHub