http://www.eq8.eu/blogs/41-policy-objects-in-ruby-on-rails

Doing authentication (verifying if user is sign-in or not) in Ruby on Rails is quite easy. You can write your own simple authentication in Rails or you can use devise gem on any equivalent and you are good to go.

When it comes to authorization (verifying if current_user has permission to do stuff he/she is requesting to) it’s a different topic. Yes there are several solutions out there that works well on small project (CanCanCan, Rolify, …) but once your project grows to medium to large scale then these generic solutions may become a burden.

In this article I will show you how you can do your Authorization with policy objects.