Class CanRouteMiddleware

Route middleware: enforce what a route or a handler declared it authorizes.

@Delete('/posts/:id', { authz: { action: 'delete', subject: 'Post' } })
@Patch('/posts/:id', { authz: 'post.update' })   // a registered policy
Copy

An ability answers what a role may do and is checked against the ability AbilityMiddleware attached. A policy answers what this caller may do to this record, so it receives the event and is resolved by the container: "may update this post" needs the post, which an ability cannot load.

Declared rather than wired, so the same fact serves the runtime and the contract: a guard hidden in a middleware list protects the endpoint but tells nothing else about it.