Besides moving attribute whitelisting to the controller rather than the model, Rails 4’s move to Strong Parameters over attr_accessible provides great documentation about the data with which records are being created. strong_parameters are good and you should feel good Here is an example of a controller many of us have written, using strong_parameters: class CommentsController < ApplicationControl