title: Assignment of a protected attribute in Rails
body: <p>I have a field on my User model that is protected because it determines clearance level. So it should be left protected and not mass-assignable. So even though attributes are protected by default in 3.2, that is actually the behavior I want.</p>
  
  <p>However, on one controller method, I want to allow a manager to assign this field, for instance on user creation or user update.</p>
  
  <p><strong>How do I allow the assignment of that attribute for specific controller actions?</strong></p>
  
  <p>For example, I have my controller:</p>
  
  <pre><code># app/controllers/admin/users_controller.rb
  
  def create
      @user = User.new(params[:user])
  # ...
  end
  </code></pre>
  
  <p>Now what I would do is exclude <code>clearance</code> from <code>params[:user]</code>, but it seems to get filtered out and raise and exception even before that line is reached (I tried putting a <code>debugger</code> right before that line and even comment it out, it still raised an exception).</p>
  
  <p><strong>Where do protected attributes get caught, if not when calling <code>User#new</code>?</strong></p>