# Field Level Security

**URL:** <https://www.ruby-forum.com/t/field-level-security/111408>\
**Category:** Rails\
**Created:** [August 7, 2007, 2:38am UTC](https://www.ruby-forum.com/t/field-level-security/111408 "2007-08-07T02:38:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [August 7, 2007, 2:38am UTC](https://www.ruby-forum.com/t/field-level-security/111408/1 "2007-08-07T02:38:43Z")

</div>

Could someone point me in a direction on how to apply field level  
security to my Rails app? Basically I have an update action on my  
controller, but based on the permissions of the person logged in, I  
want to control what fields they can update. Of course the model  
object should enforce this security as well as disabling the controls  
on the view if they don’t have the permissions to edit it.

I have been through the Simple Access Control Example (http://  
[wiki.rubyonrails.org/rails/pages/SimpleAccessControlExample](http://wiki.rubyonrails.org/rails/pages/SimpleAccessControlExample)) which is  
good for applying permissions for whole actions, but I really need to  
go more granular sometimes.

Thanks,  
Brian R

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [August 7, 2007, 8:17pm UTC](https://www.ruby-forum.com/t/field-level-security/111408/2 "2007-08-07T20:17:43Z")

</div>

On Aug 6, 2007, at 19:35 , removed\_email\_address@domain.invalid wrote:

> Of course the model  
> object should enforce this security as well as disabling the controls  
> on the view if they don’t have the permissions to edit it.

You might want to take a look at Bruce P.’ ModelSecurity for some  
ideas.

[http://perens.com/FreeSoftware/ModelSecurity/Tutorial.html](http://perens.com/FreeSoftware/ModelSecurity/Tutorial.html)

Hobo might also have something along these lines, but I haven’t  
checked it out yet.

> **[Venostech.com](https://www.venostech.com/)**
>
> Venostech.com

Michael G.  
grzm seespotcode net