title: Protect sensitive attributes with declarative_authorization
body: <p>What's a cool way to protect attributes by role using <a href="https://github.com/stffn/declarative_authorization" rel="nofollow noreferrer">declarative_authorization</a>?  For example, a user can edit his contact information but not his role.  </p>
  
  <p>My first inclination was to create multiple controller actions for different scenarios.  I quickly realized how unwieldy this could become as the number of protected attributes grows.  Doing this for user role is one thing, but I can imagine multiple protected attributes.  Adding a lot controller actions and routes doesn't feel right.</p>
  
  <p>My second inclination was to create permissions around specific sensitive attributes and then wrap the form elements with View hepers provided by declarative_authorizations.  However, the model and controller aspect of this is a bit foggy in my mind.  Suggestions would be awesome.</p>
  
  <p>Please advise on the best way to protect attributes by role using declarative_authorizations.</p>