Pundit is a Ruby authorization library that provides a minimal, object-oriented approach to managing access control in Rails applications. Rather than relying on domain-specific languages or complex configuration, Pundit guides developers to build authorization systems using plain Ruby classes and standard object-oriented design patterns. The library is maintained by Varvet and emphasizes simplicity and clarity in how permissions are structured and enforced.
The core concept of Pundit revolves around policy classes, which are plain Ruby objects that encapsulate authorization logic for specific models or resources. These policy classes follow a naming convention where a policy for a Post model is named PostPolicy and lives in the app/policies directory. Each policy class accepts a user object and a record object as constructor arguments, then implements query methods that correspond to controller actions. For example, an update? method would check whether a user is authorized to update a particular record. The library automatically infers which policy class to use and which method to call based on the controller action name, reducing boilerplate while maintaining explicit control.
Pundit provides several helper methods that integrate authorization checks into Rails controllers. The authorize method instantiates the appropriate policy class and calls the corresponding permission method, raising a Pundit::NotAuthorizedError if authorization fails. The policy method gives controllers and views direct access to policy instances for conditional rendering. For listing actions that need to filter collections based on user permissions, Pundit introduces policy scopes, which are nested Scope classes within policies that implement a resolve method to return filtered collections of records.
The library includes a verification system designed to help developers during development. The verify_authorized method can be used in an after_action hook to ensure that authorize was called in every controller action, while verify_policy_scoped performs the same check for policy_scope usage. These verification methods raise exceptions if authorization checks are forgotten, serving as development aids rather than runtime security mechanisms. Developers can conditionally bypass verification using skip_authorization and skip_policy_scope when needed.
Pundit supports several advanced patterns. Headless policies allow authorization logic for concepts without corresponding model classes by using symbols as records. Developers can manually specify which policy class to use for a given model rather than relying on naming conventions. The library supports null object patterns through NilClassPolicy for handling nil associations gracefully. Pundit also provides a generator that scaffolds an ApplicationPolicy base class with sensible defaults, establishing a foundation for policy inheritance across the application.
According to GitGenius activity tracking, the repository shows median issue and pull request response latency of 0.2 hours across 29 tracked items, indicating active maintenance. The most frequently labeled issues involve problems and feature requests, with Burgestrand being the primary contributor and triager with 65 recorded events. The repository has attracted contributors who also work on major projects including microsoft/vscode, microsoft/typescript, and rust-lang/rust, suggesting it maintains relevance within the broader Ruby and Rails ecosystem.
The design philosophy emphasizes that Pundit intentionally remains small and unopinionated. All policy and scope classes are plain Ruby, allowing developers to use standard Ruby techniques for code organization such as modules, inheritance, metaprogramming, and method aliasing. This approach means developers can build sophisticated authorization systems without learning special syntax or relying on framework magic, making authorization logic testable and maintainable using familiar Ruby patterns.
