title: Restricting authorization to individual records instead of whole controller action in Rails
body: <p>I have a Rails app with articles that belong to categories</p>
  
  <pre><code>class Article &lt; ApplicationRecord
    belongs_to :category
  
  
  class Category &lt; ApplicationRecord
    has_many :articles, dependent: :destroy
  </code></pre>
  
  <p>It has a basic User model with some roll your own authentication and authorization however I am running into a road block trying to restrict certain users to the articles under a certain category</p>
  
  <p>There are "admin" users and "internal" users.</p>
  
  <p>There is a category called Internal as well</p>
  
  <p>I want to limit the access to any article where the category is set to Internal to only admin and internal users.</p>
  
  <p>If ordinary or non-logged in users try to access articles under the Internal category they will get redirected to the home page and there will be a flash message letting them know access is denied.</p>
  
  <p>The specific pages I don't want them to see are the show page for any article with its category set to internal and the show page for the Internal category.</p>
  
  <p>The show page for the internal category iterates through all articles with their category set to Internal.</p>
  
  <p>I already have it set up to restrict unauthorized access to the new, edit and destroy pages using a before_action.</p>
  
  <pre><code>before_action :admin_user,       only: [:new, :edit, :destroy]
  
  def admin_user
        redirect_to(root_url) &amp;&amp; flash[:danger] = "You are not authorized!" unless current_user.admin?
      end
  </code></pre>
  
  <p>My main question would be is there a more fine grained way to limit access to individual records from the model instead of just the whole controller action?</p>
  
  <p>I dug into a few gems like cancancan but they all seem to be focused on limiting access to the whole controller action and not to individual records.</p>
  
  <p>Any suggestions would be greatly appreciated.</p>