← Home ← Codex ← DEBT ← Engine
Browse by Category
+ added · ✎ updated 7d
← Back to glossary

Separation of Concerns

General Beginner
debt(d7/e7/b7/t5)
d7 Detectability Operational debt — how invisible misuse is to your safety net

Closest to 'only careful code review' (d7). Deptrac can enforce layer boundaries if configured, but SoC violations are fundamentally conceptual — phpstan won't flag a 100-line controller mixing concerns. Detection relies on code review.

e7 Effort Remediation debt — work required to fix once spotted

Closest to 'cross-cutting refactor across the codebase' (e7). Untangling business logic from controllers, models, and templates typically requires extracting services, repositories, and view layers across many files — far beyond a parameterised fix.

b7 Burden Structural debt — long-term weight of choosing wrong

Closest to 'strong gravitational pull' (b7). Applies across web/cli/queue contexts and shapes every layer decision; once concerns are tangled, every future change is constrained by the existing entanglement.

t5 Trap Cognitive debt — how counter-intuitive correct behaviour is

Closest to 'notable trap most devs eventually learn' (t5). Per the misconception, developers equate SoC with file/class separation rather than conceptual boundaries — a common and documented misunderstanding, but not catastrophically counterintuitive.

About DEBT scoring →

Also Known As

SoC concern separation separation of responsibilities

TL;DR

Organising code so that each part addresses a distinct concern — business logic, data access, presentation — with minimal overlap.

Explanation

Separation of Concerns (SoC) is a design principle advocating that a module, class, or function should address a single, well-bounded concern. Mixing concerns — e.g., SQL queries inside HTML templates, or business rules inside database models — produces code that is hard to test, reuse, and change in isolation. SoC underpins MVC architecture, layered architectures, and microservices. In PHP, enforcing SoC means keeping template rendering, business logic, and data access in separate layers with well-defined interfaces between them.

Common Misconception

✗ Separation of concerns means putting each type of code in its own file or class. SoC is about conceptual boundaries — mixing business logic, presentation, and data access in the same function violates SoC regardless of how many files are involved.

Why It Matters

Each component should have one well-defined concern — mixing concerns (business logic with SQL in a controller) creates code that cannot be changed, tested, or reused without touching everything at once.

Common Mistakes

  • Controllers that contain business logic, database queries, and HTML generation.
  • Models that send emails, dispatch HTTP requests, or format output.
  • Business logic in database stored procedures — makes it invisible to application-level tests.
  • Not having a clear mental model of which layer owns which concern before writing code.

Code Examples

✗ Vulnerable
// Controller doing DB queries, business logic, AND formatting
class ProductController {
    public function show(int $id): string {
        $row = $this->db->query('SELECT * FROM products WHERE id = ?', [$id]);
        $price = $row['price'] * (1 - $row['discount']);
        return "<h1>{$row['name']}</h1><p>£{$price}</p>";
    }
}
✓ Fixed
// Controller: HTTP only
class ProductController {
    public function show(int $id): JsonResponse {
        return response()->json($this->productService->getDetails($id));
    }
}
// Service: business logic
// Repository: data access
// View/Resource: formatting

Added 15 Mar 2026
Edited 22 Mar 2026
Views 146
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
0 pings S 1 ping M 1 ping T 0 pings W 0 pings T 0 pings F 0 pings S 0 pings S 1 ping M 0 pings T 0 pings W 1 ping T 0 pings F 2 pings S 0 pings S 1 ping M 2 pings T 0 pings W 1 ping T 0 pings F 1 ping S 0 pings S 1 ping M 0 pings T 0 pings W 3 pings T 0 pings F 1 ping S 0 pings S 1 ping M
Amazonbot 1
No pings yesterday
Amazonbot 14 Scrapy 13 Perplexity 10 SEMrush 10 Ahrefs 9 ChatGPT 8 Bing 7 Google 6 PetalBot 6 Twitter/X 4 Unknown AI 2 Applebot 2 Meta AI 1 Brave Search 1 Baidu 1 Majestic 1
crawler 89 crawler_json 6
⚡ DEV INTEL Tools & Severity
🟠 High ⚙ Fix effort: High
⚡ Quick Fix
If your controller handles HTTP, business logic, database queries, and email sending, it has too many concerns — each layer should do one thing: controllers route, services orchestrate, repositories query, domain validates
📦 Applies To
any web cli queue-worker
🔗 Prerequisites
🔍 Detection Hints
Controller method with 100+ lines doing everything; SQL in template; business logic in migration; presentation logic in domain model
Auto-detectable: ✗ No phpstan deptrac
⚠ Related Problems
🤖 AI Agent
Confidence: Medium False Positives: High ✗ Manual fix Fix: High Context: File Tests: Update


✓ schema.org compliant