Authorize an invoice before accepting its update
An authenticated user changes an invoice ID in the address bar. Login proves who the user is; it does not prove that this invoice belongs to them. Put the ownership rule in the application's authorization path before performing the update.
Make the policy call visible
use Illuminate\Support\Facades\Gate;
Gate::authorize('update', $invoice);
$invoice->update($request->validated());
This fragment assumes a registered or discoverable Invoice policy and a FormRequest that validates the editable fields. The policy should check the relevant tenant relationship and role. If a FormRequest already authorizes the operation, keep the rule in that established path rather than duplicating divergent checks.
Scope retrieval as well
Loading the invoice through an account relationship can prevent accidental cross-account lookup. A policy still expresses whether the current actor may perform the action. Be deliberate about whether an inaccessible record returns 403 or is hidden behind a 404 response.
Never trust a submitted tenant_id to establish ownership. Resolve the tenant from the authenticated context, then verify any related customer or purchase belongs to that same boundary.
Test an owner, a permitted colleague, a read-only colleague, and a user from another tenant. Assert the forbidden request leaves the database unchanged, not merely that it returns an error page. Include the case where the payload tries to move the invoice into another tenant. A correct policy plus unrestricted mass assignment can still produce an unsafe update.