# Model layer access control

**URL:** <https://www.ruby-forum.com/t/model-layer-access-control/60634>\
**Category:** Rails\
**Created:** [May 16, 2006, 12:33pm UTC](https://www.ruby-forum.com/t/model-layer-access-control/60634 "2006-05-16T12:33:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Isak\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/77aa72/32.png) [@Isak\_H](https://www.ruby-forum.com/u/Isak_H)\
**Post date:** [May 16, 2006, 12:33pm UTC](https://www.ruby-forum.com/t/model-layer-access-control/60634/1 "2006-05-16T12:33:47Z")

</div>

I already have a simple role based access control system (User, Role,  
Privilege, Client) in place for my web layer, which checks  
User.authorized?(controller, action, client) from a before filter.

What do you think about using this method for auth checks on the model  
layer as well, only with made up controller/action strings? (e.g.  
“model::Period”, “close”)

A bit simplistic for a multi user/client accounting system? I’m  
certainly open for better suggestions, especially if they could  
improve ease of use/maintenance.

Any feedback appreciated,  
Isak

---

<div class="post-metadata">

**Author:** ![Isak\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/77aa72/32.png) [@Isak\_H](https://www.ruby-forum.com/u/Isak_H)\
**Post date:** [May 16, 2006, 3:26pm UTC](https://www.ruby-forum.com/t/model-layer-access-control/60634/2 "2006-05-16T15:26:41Z")

</div>

I don’t see why you would ever need to provide access control to your  
models. Access controls are for those things that the user can and  
cannot directly access. In a Rails app, those things are Controllers  
and items in the /public directory. No other parts of your Rails app  
are directly exposed, so none of those other parts need their own  
access controls…

-Brian

---

<div class="post-metadata">

**Author:** ![Isak\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/77aa72/32.png) [@Isak\_H](https://www.ruby-forum.com/u/Isak_H)\
**Post date:** [May 16, 2006, 3:48pm UTC](https://www.ruby-forum.com/t/model-layer-access-control/60634/3 "2006-05-16T15:48:48Z")

</div>

> > > > > “Brian” == Brian H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes:

> I don’t see why you would ever need to provide access control to your  
> models. Access controls are for those things that the user can and  
> cannot directly access. In a Rails app, those things are Controllers  
> and items in the /public directory. No other parts of your Rails app  
> are directly exposed, so none of those other parts need their own  
> access controls…

## It’s called “defense in depth”. If you have security in every layer, you still have some protection if the security in one layer fails. If you only have one layer of security, you lose everything if it fails.

```
	     Calle D. <removed_email_address@domain.invalid>
	 http://www.livejournal.com/users/cdybedahl/
 "I'd rather hang on to madness than normality" -- KaTe Bush

```