# Fine grained access control

**URL:** <https://www.ruby-forum.com/t/fine-grained-access-control/53773>\
**Category:** Rails\
**Created:** [February 14, 2006, 1:33pm UTC](https://www.ruby-forum.com/t/fine-grained-access-control/53773 "2006-02-14T13:33:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonny](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/47e85d/32.png) [@jonny](https://www.ruby-forum.com/u/jonny)\
**Post date:** [February 14, 2006, 1:33pm UTC](https://www.ruby-forum.com/t/fine-grained-access-control/53773/1 "2006-02-14T13:33:10Z")

</div>

Hi,

I’m building an application which is going to require quite fine grained  
access control. Deciding if a user is allowed to access an action will  
probably require checking quite number of different rules, so a simple  
role-based system won’t be flexible enough.

The approach I think I will try first is, if it’s possible, to ignore  
permission issues inside the actions. I think this may be achievable by  
using quite a complicated before\_filter to decide if the current user is  
allowed to execute this action with the given parameters.

Anyway, if anyone could lend a bit of their experience, or possibly even  
better, recommend some resources which cover building larger permissions  
systems (books, articles etc…) I’d be very grateful.

Thanks, Jonathan.

---

<div class="post-metadata">

**Author:** ![jonny](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/47e85d/32.png) [@jonny](https://www.ruby-forum.com/u/jonny)\
**Post date:** [February 14, 2006, 2:59pm UTC](https://www.ruby-forum.com/t/fine-grained-access-control/53773/2 "2006-02-14T14:59:34Z")

</div>

> Anyway, if anyone could recommend some resources which cover building larger permissions systems (books, articles etc…) I’d be very grateful.

Ditto.

I discovered what we are talking about is known as RBAC : Role-Based  
Access Control. There are several discussion at Sitepoint on the topic.

Regards

Tony Green

---

<div class="post-metadata">

**Author:** ![jonny](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/47e85d/32.png) [@jonny](https://www.ruby-forum.com/u/jonny)\
**Post date:** [February 15, 2006, 4:29am UTC](https://www.ruby-forum.com/t/fine-grained-access-control/53773/3 "2006-02-15T04:29:02Z")

</div>

Ack… a bit tired… that should be “gem install  
model\_security\_generator”.

---

<div class="post-metadata">

**Author:** ![jonny](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/47e85d/32.png) [@jonny](https://www.ruby-forum.com/u/jonny)\
**Post date:** [February 15, 2006, 4:26am UTC](https://www.ruby-forum.com/t/fine-grained-access-control/53773/4 "2006-02-15T04:26:01Z")

</div>

AC Green wrote:

> Tony Green

Bruce P. wrote a RBAC called ModelSecurity. It’s available as a gem:

gem install model\_security

Here’s the site:

[http://perens.com/FreeSoftware/ModelSecurity/Tutorial.html](http://perens.com/FreeSoftware/ModelSecurity/Tutorial.html)

b

---

<div class="post-metadata">

**Author:** ![jonny](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/47e85d/32.png) [@jonny](https://www.ruby-forum.com/u/jonny)\
**Post date:** [February 16, 2006, 2:51pm UTC](https://www.ruby-forum.com/t/fine-grained-access-control/53773/5 "2006-02-16T14:51:34Z")

</div>

AC Green a écrit :

> > Anyway, if anyone could recommend some resources which cover building larger permissions systems (books, articles etc…) I’d be very grateful.
> 
> I discovered what we are talking about is known as RBAC : Role-Based  
> Access Control. There are several discussion at Sitepoint on the topic.

See [https://activerbac.turingstudio.com/](https://activerbac.turingstudio.com/)  
It implements RBAC for rails.