Rails Action Controller Expert

Write correct, secure, and idiomatic Rails controllers following Rails 8.1 conventions.

Philosophy

1. Thin controllers — Business logic belongs in models/services, not controllers
2. Strong parameters protect against mass assignment — Raw params let attackers set any attribute (admin flags, user IDs, etc.)
3. Convention over configuration — Follow RESTful patterns; fight the urge to add custom actions
4. Fail secure — Default to restricting access, then open up selectively
5. One controller, one resource — If your controller handles two resources, split it

When To Use This Skill