title: Laravel - Policy authorization on user and object that both belong to something
body: <p>I want to authorize my API of my Laravel application.
  My structure right now is like this:</p>
  
  <p>Users belong to an organization, and the organization has many (lets say) objects.
  Now I want that only users can view/edit/create/delete objects, that belong to the organization they are part of.</p>
  
  <p>My API route for viewing the objects is:</p>
  
  <pre><code>Route::get('organizations/{id}/objects','ObjectController@indexOrganization')-&gt;middleware('auth:api');
  </code></pre>
  
  <p>I created the Models User, Organization and Object. They all have their own Controller.</p>
  
  <p>I created the ObjectPolicy and tried this:</p>
  
  <pre><code>public function view(User $user, Object $object)
      {
        return $user-&gt;organization_id === $object-&gt;organization_id;
      }
  </code></pre>
  
  <p>And then I added <code>-&gt;middleware('can:view,object');</code> to the route. 
  Unfortunately, it does not work and the Laravel documentation does not provide the information I need.</p>
  
  <p>Can someone help?
  Thanks!</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>I have no idea what I'm doing wrong!! I Changed everything but I still get a 403 response.</p>
  
  <p>Here is my code:</p>
  
  <p>Route:</p>
  
  <pre><code>Route::get('organizations/{organization}/objects','ObjectController@index Organization')-&gt;middleware('auth:api', 'can:view, organization');
  </code></pre>
  
  <p>OrganizationPolicy:</p>
  
  <pre><code>public function view(User $user, Organization $organization)
  {
      return $user-&gt;organization_id === $organization-&gt;id;
  }
  </code></pre>
  
  <p>ObjectController:</p>
  
  <pre><code>public function indexOrganization(Organization $organization)
  {
    $objects = $organization-&gt;objects;
    return ObjectResource::collection($objects);
  }
  </code></pre>
  
  <p>I also added this to my <code>AuthServiceProvider</code>:</p>
  
  <pre><code>protected $policies = [
      'App\Model' =&gt; 'App\Policies\ModelPolicy',
      App\Organization::class =&gt; App\Policies\OrganizationPolicy::class,
  ];
  </code></pre>
  
  <p><strong>EDIT 2 / SOLUTION</strong></p>
  
  <p>The answer from newUserName02 works! The problem was inside the <code>AuthServiceProvider</code>. After I changed the code (see above in Edit) there to:</p>
  
  <pre><code>protected $policies = [
      'App\Model' =&gt; 'App\Policies\ModelPolicy',
      'App\Organization' =&gt; 'App\Policies\OrganizationPolicy',
  ];
  </code></pre>
  
  <p>it worked! </p>