Gates are closure-based authorization checks for an ability, such as viewing an admin dashboard or performing an action that is not naturally tied to one model. They are typically defined centrally and checked through the Gate facade or authorization helpers.

Policies are classes that organize authorization rules around a particular model or resource, with methods such as view, create, update, and delete. Use policies for resource-specific permissions and gates for simpler or broader abilities. Both should be based on server-side facts, not only on what the client claims it may do.