$fillable is an allowlist of model attributes that may be set through mass-assignment methods such as create, fill, and update. $guarded is a blocklist of attributes that must not be mass assigned; an empty guarded array makes every attribute assignable and therefore requires extra care.

They protect model columns from unexpected request input, such as an is_admin field. Prefer a deliberate allowlist for models that receive user-controlled data, validate the incoming request first, and avoid relying on a broad unguarded setting. A model should normally use one clear mass-assignment strategy rather than conflicting rules.