[Empact]

Yep, and the new strong_parameters library from core team supports this and is a taste of things to come: moving towards consistently controller-based access-control. http://weblog.rubyonrails.org/2012/3/21/strong-parameters/

[tptacek]

I am not, by the way, sold on this particular ideology about models and controllers. The controller-based pattern has stuff to recommend it, as does the model-based pattern. I think most apps are going to end up wanting to do both.