For some reason I cannot add comments to the Serializer.

$canEdit = $gate->allows('edit.credentials') || $gate->allows('edit.groups') || $gate->allows('edit.username') ? true : false;

The last ?: is superfluous. I also highly doubt it does what you expect. The condition applies only to the last gate allow method, not all three.

Why exactly are there no new policy methods, are these magically applied? Would you have kept the user as an argument to the allows method and created the methods on the UserPolicy you could have moved the EditUserHandler change to the Policy to enforce it globally, I think that's the better solution here..

In theory this could work without a policy: if no policy governs a permission, there'll be a check as to whether the user belongs to a group that has that permission.

However, I agree that a policy could be useful here, as that'd be a better place to put the if user->isAdmin() => assertAdmin($actor) logic, so that we keep the permission layer separate from the editing logic.