Abilities

An ability exists in exactly one place, the catalog. Minting checks a token against it, and a self-service screen offers and labels what it holds. Name each ability with the label a person reads, a translation key or the text itself:

// config/sanctum-hardening.php
'abilities' => [
    'orders:read' => 'Read orders',
    'orders:write' => 'Write orders',
],

An application that registers its abilities in code defines them in a service provider:

use Pushery\SanctumHardening\Abilities\AbilityCatalog;

public function boot(): void
{
    $this->app->make(AbilityCatalog::class)->define('reports:read', 'Read reports');
}

No wildcard

* is no ability. A token names what it may do, and a check that asks for tokenCan('orders:read') answers from that list. Asked to mint the wildcard, an ability the catalog does not know, or no ability at all, the package refuses with an AbilityRefused exception, whose reason is wildcard, unknown or none. It never mints a token with fewer abilities than were asked for.

Reserved abilities

Some tokens belong to the application rather than to a person, the token a device signs in with for instance. Their abilities are reserved:

'reserved' => [
    'device:sync',
],

A reserved ability can only be minted through mintForSystem(). The self-service neither offers it nor lists a token that carries one, and it cannot revoke such a token. A token with a reserved ability does not count against a person's limit either.