Hacker News new | ask | show | jobs
by ww520 5212 days ago
Precisely because there can be so many places (controllers) that can access the model, usually you use declarative access control rules on the model to control access in one place. It can be done with role. Then whoever user having the role can access the model.