# Proper place to propose a permissions predicate?

**URL:** https://meta.discourse.org/t/proper-place-to-propose-a-permissions-predicate/352637
**Category:** Development
**Created:** [February 17, 2025, 4:07am UTC](https://meta.discourse.org/t/proper-place-to-propose-a-permissions-predicate/352637 "2025-02-17T04:07:02Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![mdoggydog](https://avatars.discourse-cdn.com/v4/letter/m/82dd89/32.png) [@mdoggydog](https://meta.discourse.org/u/mdoggydog)
#### Post date: [February 21, 2025, 11:31pm UTC](https://meta.discourse.org/t/proper-place-to-propose-a-permissions-predicate/352637/2 "2025-02-21T23:31:45Z")

</div>

Here is what I have learned/deduced:

- `Guardian` is indeed the thing that encapsulates _“What is the user allowed to do?”_ (A `Guardian` instance has-a `User` instance, too.)
- Thus, the proper place for a permissions predicate is simply as a method on `Guardian` (`lib/guardian.rb`).
  - If the method is a “Can the user do Z to an Xxxx object?” then it probably belongs in one of the `XxxxGuardian` mixin files (`lib/guardian/...`).
  - Otherwise, it goes into the base `Guardian` definition.

- `ApplicationController` manages a `guardian` attribute reflecting the current request/client, and provides it to serializers as their `scope`, so the current `Guardian` is available when needed (except when it isn’t\[1\])
- There are places where a ready-made `Guardian` is not available, typically in a backend task run by the system, but if you have a handle on an “acting user” (e.g., the recipient user, when generating an email notification), you can create a appropriate guardian on the fly: `Guardian.new(the_user)` .

* * *

1. 

> [@Forwarding the \`scope:\` down a tree of serializers: just do it, or not?](https://meta.discourse.org/t/forwarding-the-scope-down-a-tree-of-serializers-just-do-it-or-not/353691):
>
> Serializers can be provided with a scope: parameter intended to provide the permissions-context for the serializer. In the Discourse code, the provided scope is a Guardian, and it looks like every serializer is intended to receive a Guardian as its scope. ApplicationController (the base class of all the controllers) maintains a Guardian and it has multiple mechanisms to try to ensure that Guardian is injected as the scope: for all serializers. However, not every scenario is not covered by the…

---

_[View the full topic](https://meta.discourse.org/t/proper-place-to-propose-a-permissions-predicate/352637)._