> For the complete documentation index, see [llms.txt](https://acf.spomky-labs.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://acf.spomky-labs.com/the-project/the-project.md).

# What is Access Control?

A component that answers one question: **is this requester allowed to perform this action on this subject?**

That is authorization, and nothing else. Authentication is a separate concern with a separate answer, and this component never asks it.

## Why it exists

Authorization in a PHP application tends to end up spread across places that do not know about each other: voters in one component, URL rules in a firewall, an attribute on a controller, an expression in a workflow guard, a function in a template. Each of them re-implements a piece of the same idea, and they drift.

This component holds the idea once:

* **voters** that answer a question,
* **combining algorithms** that turn several answers into one,
* **access policies** declared where they apply,
* **decisions** that say why they were reached.

Everything else, the controller attribute, the URL rule, the template function, the console guard, the workflow guard, is an entry point onto the same machinery.

## It does not need an authentication stack

There is no user in the vocabulary, no token, no firewall. The requester is `mixed`: a Symfony token when you have one, and otherwise a service account, a machine actor, an API key, or a string. A voter that does not understand a requester abstains.

`symfony/security-core` is optional throughout, and the classes that know it live in `AccessControl\Bridge\Security`. An application with Security keeps it and changes nothing; an application without it can express everything the same way.

## It says why

A decision is not a boolean. It carries the verdict, the reason, and who voted which way.

That is what makes a refusal diagnosable six months later, and it is what the profiler panel, the log and the test assertions all read. A denial reaching an HTTP response is still a bare `403`: the diagnostic is available to the developer and withheld from the visitor.

## The failure it is built against

A guard that lets somebody through is the only unacceptable failure, and it is silent. Nothing in a test suite goes red, nothing in a log goes wrong; access rules simply stop applying.

So the component is built to fail loudly instead. What the Symfony bridge cannot absorb raises at compile time rather than at runtime: two combining algorithms named at once, two sets of URL rules, two role hierarchies, contradictory settings, a template function Security would publish that we did not expect. What a reprise cannot do refuses out loud rather than answering `false`, because a refusal a template cannot tell from a real one is the same family of fault.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://acf.spomky-labs.com/the-project/the-project.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.