RE: modelling data to specify user access

Sounds like:

A Gallery has many Images
A User has many Galleries

A guest user could be assigned the default protfolio that everyone can
see.

Not sure how this looks in Rails HABTM??? but the two additional tables
would be:

Gallery_Images (plurals??)
*gallery_id
*image_id

Gallery_Users
*gallery_id
*user_id

Ross