# Authlogic and controlling the resources users can access

**URL:** <https://www.ruby-forum.com/t/authlogic-and-controlling-the-resources-users-can-access/192533>\
**Category:** Rails\
**Created:** [August 1, 2010, 12:36pm UTC](https://www.ruby-forum.com/t/authlogic-and-controlling-the-resources-users-can-access/192533 "2010-08-01T12:36:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bingobob](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e480ec/32.png) [@bingobob](https://www.ruby-forum.com/u/bingobob)\
**Post date:** [August 1, 2010, 12:36pm UTC](https://www.ruby-forum.com/t/authlogic-and-controlling-the-resources-users-can-access/192533/1 "2010-08-01T12:36:04Z")

</div>

question re authlogic, all set up but now i’d ike to control access to a  
resource so only users who own that resource can control it, I figure I  
put this in the Advert controller - is this approach sound ?

[http://pastie.org/1069488](http://pastie.org/1069488)

I also specify that an admin (just a boolean controlled user) can edit  
everything… is it good ?

User, has many Adverts and Advert belongs to a User

Just about to implement this in a new app and wanted a second opinion.

cheers

bb

---

<div class="post-metadata">

**Author:** ![bingobob](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e480ec/32.png) [@bingobob](https://www.ruby-forum.com/u/bingobob)\
**Post date:** [August 2, 2010, 11:26am UTC](https://www.ruby-forum.com/t/authlogic-and-controlling-the-resources-users-can-access/192533/2 "2010-08-02T11:26:28Z")

</div>

Is this approach sound?