policy

Create secure Pundit authorization policies with deny-by-default and RSpec tests.

Updated Mar 19, 2026

Search Tags:#tdd #authorization #policy #ruby #rails #rspec #pundit

Ready to run

npx skills add https://github.com/reckerswartz/resume_builder --skill policy-reckerswartz

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: policy
Source: https://github.com/reckerswartz/resume_builder/tree/main/.devin/skills/policy
Command: npx skills add https://github.com/reckerswartz/resume_builder --skill policy-reckerswartz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Pundit-based authorization policies can be easily misconfigured, creating security gaps or brittle tests. This Skill provides a structured approach to building secure, deny-by-default policies with clear role-based access, scoping rules, and deterministic testing.

Core Features & Use Cases

Define reusable policy patterns (Basic CRUD with owner checks, Role-based access, State-conditioned actions, and Headless policies for non-model actions).
Enforce testable scopes and permitted attributes, with comprehensive RSpec coverage and controller/view integrations.
Use in Rails apps to reduce authorization drift, accelerate safe feature rollout, and improve maintainability with standardized policy templates.

Quick Start

Create a new policy under app/policies, add corresponding specs under spec/policies, and run the test suite to verify behavior.

Frequently Asked Questions about policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I set up deny-by-default Pundit authorization policies in Rails?▼

Deny-by-default Pundit authorization policies are established by creating structured policy files under app/policies that enforce role-based access and scoping rules. This approach ensures secure access control by restricting permissions unless explicitly permitted.

How do I write RSpec tests for Pundit policies and scopes?▼

RSpec tests for Pundit policies are generated by adding corresponding spec files under spec/policies using deterministic policy spec templates. Running the test suite verifies behavior across models, controllers, and views to ensure comprehensive authorization coverage.

What is the best way to enforce role-based access control with Pundit in a Ruby on Rails application?▼

Role-based access control with Pundit is enforced by defining reusable policy patterns like Basic CRUD with owner checks, role-based access, and state-conditioned actions. This reduces authorization drift and accelerates safe feature rollout in Rails apps.

Can I use Pundit for non-model actions in Rails controllers?▼

Pundit can be used for non-model actions by applying headless policies. These allow authorization enforcement for controller actions that do not map directly to ActiveRecord models, maintaining consistent access control logic.

Does this approach require any additional dependencies beyond Pundit and RSpec?▼

No additional dependencies are required. The approach relies solely on standard Pundit and RSpec patterns like ApplicationPolicy and Scope, leveraging existing Rails conventions to ensure maintainable and testable authorization.