Validate a unique email on edit without trusting an ignore ID
A profile edit should allow a user to keep their current email while rejecting another account's email. The uniqueness rule needs to exclude the current record, but that exclusion must come from the authenticated model rather than an arbitrary request field.
Ignore the trusted model
use Illuminate\Validation\Rule;
$rules = [
'email' => ['required', 'email', Rule::unique('users', 'email')->ignore($request->user())],
];
This is a validation fragment for an authenticated profile update. Do not pass a request-controlled ignore_id into the rule. If an administrator edits another account, first load and authorize that account, then use that trusted model.
Validation is not a concurrency constraint
Two requests can both pass a uniqueness check before either saves. Keep the corresponding database unique constraint and handle a conflict cleanly. Validation gives a helpful normal-path message; the database protects the invariant under concurrency.
Decide whether uniqueness is global or scoped to a tenant. The validation query and database index must agree. A global unique index with a tenant-scoped validator produces confusing failures; the reverse may allow duplicates you intended to prohibit.
Test unchanged email, a new unused email, an existing email, and an attempted ignore-ID injection. Include whatever case-normalization policy your application uses. Do not assume the validator and database collation make identical case-sensitivity decisions without checking. For account emails, changing the address may also require reverification, which is a separate workflow from uniqueness.