> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Add Authorisation at the Start!
- URL: https://securinglaravel.com/security-tip-add-authorisation-at-the-start/
- Published: 2025-07-13T03:38:33.000Z
- Updated: 2025-07-13T03:38:33.000Z
- Description: [Tip #116] Is it a "premature optimisation" to add authorisation to your app before you know how your authorisation will be structured?
- Author: Stephen Rees-Carter
- Tags: Security Tips, Authorisation

Let's answer a question raised in episode [*89: Money Mindset*](https://mostlytechnical.com/episodes/89-money-mindset?ref=securinglaravel.com#t=33m22s)of the [Mostly Technical Podcast](https://mostlytechnical.com/?ref=securinglaravel.com). [Ian Landsman](https://bsky.app/profile/ianlandsman.com?ref=securinglaravel.com) was working on a new app, and was asking if he should be adding in authorisation gates now, before he works out how permissions will work, or if he should leave the gates out and add them in later when permissions are ready.

This caught my attention, and raised the following question:

> Is it a "premature optimisation" to add authorisation (permissions) to your app before you know how your authorisation will be structured, or should you consider authorisation and add placeholders when writing new code and building new features from the start?

To which my answer is:

**Yes, put authorisation (or placeholders) in from the start!**

Even if you're only using placeholders that `return true` or fallback to a global permission level (i.e. `Edit Game` \-> `View Game` \-> `Active Subscription`), there are two main benefits:

1. When you do need to add authorisation, you won't need to manually trawl your code looking for all the areas that need authorisation - and inevitably miss some of them!
2. You'll be designing your code with authorisation in mind, adding in boundaries and segregating different permission-levels of your code from the start, so you don't need to come along later and manually refactor a tightly woven piece of essential functionality to get permissions working.

Ultimately, the term "premature optimisation" just doesn't make sense in a lot of security contexts, because security can't be a reactive process - it needs to be proactive. When it comes to improving performance by adding caches or database indexes, you can wait until your monitoring tools report slow routes, but you can't wait for a data breach to tell you which routes are missing permissions checks.

🤣

**Ok, you can wait for a data breach... but do you really want everyone learning the name of your app because it's ended up in* [**Have I Been Pwned?*](https://haveibeenpwned.com/?ref=securinglaravel.com)

All of that said, you do need to factor into it what the app does and how complex it is going to be. Will it actually need permissions? Will my placeholders accurately represent the permissions that I might need? Security folks can be very black-and-white about "you need proper authorisation", so you do need to factor in context too.

I would love to hear your thoughts on the subject - do you agree with me, or am I just being paranoid? How do you handle authorisation in a new app? *Shout out in the comments or* [*on socials*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*!*

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* 

*You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*