The layer Laravel's notifications leave out: stored notifications with read state, per-recipient channel preferences, and a gate chain that decides delivery before via() runs.

Device-bound login sessions for Laravel: per-device remember-me tokens, a "where am I signed in" device list, and revoke/rename — privacy-respecting and Fortify-agnostic.

Policy-based access control for Laravel: roles, permissions, organisation-scoped authorization, Gate integration, and a decision cache.