Filament Back-Office

Filament /admin is the application’s only user interface, for content managers and administrators alike. / redirects to it.

Where to work

Authorization model

Filament uses three authorization tiers:

1. Panel access uses the access-admin-panel permission.
2. Navigation and resource visibility use feature permissions such as view-data, manage-users, manage-roles, manage-settings, and manage-reference-data.
3. Record and action authorization uses existing policies in app/Policies/.

Authentication

Every authentication page is a Filament page under app/Filament/Auth/:

• login;
• the two-factor challenge and setup;
• password reset and its two-factor step;
• registration.

They are built on Laravel Fortify: they and the profile page call its actions (CreateNewUser, UpdateUserPassword, UpdateUserProfileInformation, the two-factor actions) and its two-factor provider directly. Fortify itself serves no route (Fortify::ignoreRoutes()), so don’t add one; add a Filament page instead.

• Registration is open only while the self_registration_enabled setting is on.
• E-mail verification: every verification message links to /admin/email-verification/verify/{id}/{hash}. The route sits outside the panel’s authentication, because a self-registered user verifies before an administrator approves them.
• The login page tells the owner of an unverified or unapproved account what is missing.
• Connected apps: apps you authorized through OAuth, such as an AI assistant connected to the MCP server, are listed on the Connected apps page, reached from the profile or the user menu. Revoke ends an app’s access at once.

Test placement

Put new Filament tests under tests/Filament/.

Business references

• Inventory Principles explains why Filament is the main back-office.
• Core Model explains the entities shown in Filament resources.