# How to restrict/control access to certain model attributes depending on role

**URL:** <https://www.ruby-forum.com/t/how-to-restrict-control-access-to-certain-model-attributes-depending-on-role/188884>\
**Category:** Rails\
**Created:** [May 19, 2010, 9:33pm UTC](https://www.ruby-forum.com/t/how-to-restrict-control-access-to-certain-model-attributes-depending-on-role/188884 "2010-05-19T21:33:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![corin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/6de8d8/32.png) [@corin](https://www.ruby-forum.com/u/corin)\
**Post date:** [May 19, 2010, 9:33pm UTC](https://www.ruby-forum.com/t/how-to-restrict-control-access-to-certain-model-attributes-depending-on-role/188884/1 "2010-05-19T21:33:51Z")

</div>

Hi!

Assume I have a model named Thread.

Normal users should be able to change the attributes [title, body].  
Admin users should be able to change [title, body, sticky, …].

Now I wonder what’s the corrent/best way to restrict/control access to  
certain model attributes depending on the current user’s role etc.

I currenty do it like this:  
Depending on the current user’s role the controller creates an  
instance of UserPost or AdminPost. This gives me the ability of  
different templates, different callbacks etc. which is great and what  
I need. But the problem is rails thinks UserPost/ AdminPost is a STI  
(because UserPost \< User) and so looks for a column named  
‘type’ (especially when using mongoid). But these are actually not STI  
but only helper models. How can I “turn off” STI, but still make rails  
use the “posts” table (and not “user\_posts”/ “admin\_posts”)?

Solutions for rails 3 would be best 🙂

Thanks,  
Corin