Question: Developing an app with laravel I realised that what can be done with `Policy` can exactly be done with `Middleware`. Say I want to prevent a user from updating a route if he/she is not the owner of the information, I can easily check from the route and can do the same from the policy.

So my question is why should I use `policy` over middleware and vice versa

Answer: 
Route middleware allows you to apply request handling to a large range of routes, instead of repeating the code in every controller action - checking authentication and redirecting guests is a good example. Controllers instead contain logic unique to specific routes/actions - you could use middleware for this, but you'd need separate middleware for every route's logic and it would all get very messy.

Policies/abilities are simply a way of checking user permissions - you can query them from a controller, or from middleware, or anywhere else. They only return true or false, so they aren't equivalent to controllers or middleware. Most of the time abilities will be comparing a user to another model, which will have been loaded based on an identifier sent to a controller action, but there are probably some applications for use with middleware too.
I have asked myself the same question. In practice, I predominantly use middleware.
My most common usage is when authorisation is only allowed for a specific user, for instance:

```
public function update(User $user, user $model)
{
    return $user->id === $model->id;
}

```

Though, even in the instance above, Yes, one could do without it and write their own logic in the controller to do the same thing.

I also like the before method, which I use to allow the administrator full-privileges for a model, for example:

```
public function before($user, $ability)
{
    if ($user->admin === 1) {
        return true;
    }
}

```

The main reason, though, why I have started to use Policies on some Laravel projects is because of what you can do with blade. If you find yourself setting permissions numerous times for the same user authorisation in your blade files, for example, to show an edit button, then Policies may become very useful because you can do the following with them (and more):

```
@can('update', $post)
<button class="btn btn-primary">Edit Post</button>
@endcan

@cannot('create', App\Models\Post::class)
<div class="alert alert-warning">You are not allowed to create a post</div>
@endcannot

```

I sometimes find these Policy-referencing blade methods to be super useful, when wanting to group authorisation in one place.