For building APIs (and not only) I have been using Pundit gem for years. It’s an awesome gem. However there is a tiny issue: Pundit has a black and white policy whereas in APIs usually you need a grayscale. The user might have access to a specific resource/action, but only in certain attributes of that resource. That’s why flexible_permissions was born: a successful pattern I have been using for a couple years now is wrapped in a gem! Checkout the github page for more info!