Remove all the Rights logic from your controller and create clean, reusable filters and tests. before_filter :can_write, :only => [:destroy,:update,:edit,:new,:create] ... access_denied unless user.can_write?(requested_object)