This finishes the series on building authorization from scratch by refactoring the permission logic into a DSL, restricting authorization with attributes, and combining with strong_parameters to protect params. (20 minutes) If you found this helpful, please consider purchasing RailsCasts Pro.