Let’s assume a simple and common scenario. I have a User model with an

Question

Asked: May 22, 20262026-05-22T18:50:03+00:00 2026-05-22T18:50:03+00:00

Let’s assume a simple and common scenario.

I have a User model with an admin field. Users cannot edit their admin field, but admins can edit anyone’s admin field.

So, I need to give both types of users appropriate access.

If I’d present this in a RESTful way, I’d have two resources, say

resource :user
namespace :admin do
  resources :users
end

…And here comes the dilemma – how do I control where the admin field can be changed and where not?

I can set attr_protected :admin to prevent users from changing their admin status. But then I’d have to make a special case out of it in Admin::UsersController, like
```
@user.admin = params[:user][:admin]
```
I can scrub the parameter in the UsersController, which is even worse
```
params[:user].delete(:admin)
```

Both of these solutions look messy to me. What’s the correct way of dealing with such situations?

What if there’s more than 2 access levels?