You can still use attr_accessible in the controller-layer. class AccountsController < ApplicationController include ActiveModel::MassAssignmentSecuri

You can still use attr_accessible in the controller-layer. class AccountsController < ApplicationController include ActiveModel::MassAssignmentSecurity attr_accessible :first_name, :last_name ... http://api.rubyonrails.org/classes/ActiveModel/MassAssignmentSecurity/ClassMethods.html http://api.rubyonrails.org/classes/ActiveModel/MassAssignmen... explicitly states: Note that using Hash#except or Hash#slice in place of attr_accessible to sanitize attributes won’t provide sufficient protection. I agree with you, though. Model-level attr_accessible, if nothing else, is flatly annoying. I feel inconvenienced by a measure that's supposed to protect against malicious users. And I feel like the terrorists have already won. I'm no MVC guru, but it makes sense to me that the Controller would deal with what amounts to the params that are on their way to the model. Why should the model have to worry about mass assignment?