Devise + Pundit + Rodauth

Authentication = "who you are". Authorization = "what you can do". AI agents conflate them and reach for whatever gem name they saw most recently. This skill picks the right combo per use case and locks in the secure defaults.

The opinion

Default monolith stack: Devise (authn) + Pundit (authz). When Devise hits its limits (MFA, WebAuthn, audit logging, account-level password policies, OAuth2 server), switch to Rodauth. For API-only apps, devise-jwt or rodauth-rails. For tiny apps, Rails 8's built-in bin/rails generate authentication is enough — skip Devise.

Counter-positions:

• CanCanCan (ability-based DSL): popular historically. We default to Pundit — its plain-Ruby policy-per-model maps cleaner to OOP. CanCanCan's centralized Ability class becomes hard to read at scale.
• Clearance (thoughtbot): minimalist, no email confirmation. Fine for greenfield, but Devise's modules cover more out of the box.
• Rolling your own auth: don't. Auth is hard. Use a library.

Decision matrix — pick the auth stack