1. Code
  2. Ruby on Rails

Authorization With Pundit


Pundit is a tool that allows you to restrict certain parts of your Rails application to authorized users. It does this by providing you with certain helpers.

In this tutorial, you will build a blog that restricts parts such as creating, updating and deleting articles to authorized users only.

Getting Started

Start by generating a new Rails application.

The -T flag tells Rails to generate the new application without the default test suite. Running the command will generate your Rails application and install the default gems.

Go ahead and add the following gems to your Gemfile. You will be using bootstrap-sass for the layout of your application, and Devise will handle user authentication.

Run the command to install the gem.

Now rename app/assets/stylesheets/application.css to app/assets/stylesheets/application.scss. Add the following lines of code to import bootstrap.

Create a partial named _navigation.html.erb to hold your navigation code; the partial should be located in app/views/layouts directory. Make the partial look like what I have below.

For the navigation to be used, you need to render it in your application layout. Tweak your application layout to look like what I have below.

Generate the User Model

Run the command to install Devise.

Now generate your User model.

Migrate your database.

Generate Article Resources

Run the command to generate your Article resources.

This will generate your ArticlesController and Article Model. It will also generate the views needed.

Now migrate your database by running:

Open up app/views/articles/_form.html.erb and make it look like what I have below.

For your index file, it should look like this.

The above code arranges the articles on the index page into a table format to make it look presentable.

Open up your routes file and add the route for articles resources.

Integrate Pundit

Add the Pundit gem to your Gemfile.

Run the command to install.

Integrate Pundit to your application by adding the following line to your ApplicationController.

Run Pundit's generator.

This will generate an app/policies folder which contains a base class with policies. Each policy is a basic Ruby class.

This is how the base class policy looks.

Create the Article Policy

Now you need to write your own policy. For this tutorial, you want to allow only registered users to create new articles. In addition to that, only creators of an article should be able to edit and delete the article.

To achieve this, your article policy will look like this.

In the above, you are permitting everyone (registered and non-registered users) to see the index page. To create a new article, a user has to be registered. You use user.present? to find out if the user trying to perform the action is registered.

For updating and deleting, you want to make sure that only the user who created the article is able to perform these actions.

At this point, you need to establish a relationship between your Article and User model.

You do so by generating a new migration.

Next, migrate your database by running the command:

Open the User model and add the line that seals the relationship.

Your Article model should have this.

Now you need to update your ArticlesController so it is in sync with what you have done so far.

At this point in your application, you have successfully implemented the policies that restrict certain parts of your application to selected users.

You want to add a standard error message that shows whenever a non-authorized user tries to access a restricted page. To do so, add the following to your ApplicationController.

This code simply renders a basic text that tells the user s/he is not authorized to perform the action.


To start your Rails server, point your browser to http://localhost:3000 to see what you have.


In this tutorial, you learned how to work with both Devise and Pundit. You were able to create policies that allowed only authorized users to view certain parts of the application. You also created a basic error text that shows when a non-authorized user tries to access a restricted part of the application.

You can learn more about Pundit by checking the GitHub page.

Looking for something to help kick start your next project?
Envato Market has a range of items for sale to help get you started.