plutonium-policy

Multi-tenant authorization policies in Rails are defined by extending ResourcePolicy, overriding core methods like create? and read?, and applying relation_scope to enforce per-entity access control. Derived actions inherit logic to share authorization rules.

Attribute permissions for create and read actions are restricted using permitted_attributes_for_create and permitted_attributes_for_read methods, controlling exactly which fields users can set or view within the resource policy.

Bulk action authorization with per-record checks is handled natively by running intersection-based validations across the collection, tightening UI visibility and ensuring only authorized records process successfully.

Relation_scope for nested resource scoping works by applying default_relation_scope and parent/entity scoping mechanics, automatically filtering collection access to enforce multi-tenancy boundaries across related models.

ActionPolicy controls association rendering and nested forms by defining permitted_associations within the policy class, restraining related data exposure and securing nested form inputs based on user authorization.

Explicit overrides for create? and read? methods are required to establish baseline authorization, while derived action methods like update? automatically inherit from create? to share logic without duplication.