Rails multi level model security

Question

I have the need to do the following in Rails to mirror a desktop application:

a User and an Office 'owns' a record, if you don't own the record on a user or office level you're kicked into the public realm.

user gets read,write,delete to the model record office gets read/write/delete to the model record other or public gets read/write/delete to the model record

e.g.

UserA owns a model record with read/write/delete OfficeA owns a model with read/write other/public gets read

I was wondering if a plugin/gem existed to grant this functionality?

Answer 1

You need an authorization framework like cancan or declarative_authorization for that.