plutonium-policy

What problem does it solve?

Policies control WHO can do WHAT with resources. Built on ActionPolicy.

Core Features & Use Cases

• Attribute permissions (permitted_attributes_for_read, permitted_attributes_for_create) to control which fields can be read or set.
• Association permissions (permitted_associations) to restrain related data rendering and nested forms.
• Automatic entity scoping for multi-tenancy to enforce per-entity access.
• Derived action methods (e.g., update? inherits from create?) to share authorization logic.
• Bulk action authorization with per-record checks and intersection-based UI tightening.
• Comprehensive collection and nested-resource scoping via relation_scope, default_relation_scope, and skip/default mechanics.

Quick Start

Instantiate a policy class (e.g., PostPolicy) extending ResourcePolicy and override core methods like create? and read? while configuring relation_scope for multi-tenancy.