Between the incoming request and the code that answers it lies a chain of layers. Each one can inspect the request, change it, let it through or turn it away. In Laravel such a layer is called middleware.
Typical questions answered there: is the caller signed in? Do they hold the necessary role? Did the request come from a form on this site? How many calls came from this IP address in the last minute?
Why this is the right place
The rule exists once and applies to every route underneath it. Middleware demanding a sign-in for the whole administration area cannot be forgotten when a new page is added.
This is where many applications come unstuck. The check sits in the interface, a button gets hidden, and the address behind it stays open. What we keep running into on this is in the article what keeps turning up in Laravel audits.