where('module_id', auth('remote')->id()); } // when update, check owner protected static function boot() { parent::boot(); static::updating(function ($model) { if ($model->module_id !== auth('remote')->id()) { abort(403, 'Unauthorized action.'); } }); } }