title: Laravel Controller update model from different users
body: <p>In my Laravel application, I have a Model called <code>Project</code> which has, among others, a property called <code>approved_at</code>. There is also a <code>ProjectController</code>, which contains the usual methods *(<code>index</code>, <code>show</code>, <code>create</code>, <code>update</code>, <code>edit</code>...)</p>
  <p>Now, the user that created the <code>Project</code> can edit it (modifying its other attributes), but only some &quot;staff&quot; members have the right to approve one.</p>
  <p>From what I understand, there can be two ways to handle the approval operation:</p>
  <ol>
  <li>Both users, from their respective views (let's call them <code>edit</code> and <code>approve</code>) fire the <code>ProjectController@update</code> method, which will internally distinguish who-can-do-what by means of authorization or policies;</li>
  <li>I create a new <code>ProjectApprovalController</code>, with its own <code>update</code> method, and check the authorization at the endpoint (eg, <code>/projects/{id}/approve</code>).</li>
  </ol>
  <p>What is the best approach to tackle this behaviour?</p>