title: Multiple user levels for updating same table
body: <p>I am trying to build one simple web site where users can write articles but admin needs to approve them before they show up on the web site. Also, after user creates article, article is not immediately sent to admin. User first needs to click on button "Send" on article properties.</p>
  
  <p>I have this model:</p>
  
  <pre><code>create_table "articles", force: true do |t|
      t.string   "title"
      t.text     "content"
      t.datetime "created_at"
      t.datetime "updated_at"
      t.boolean  "published",   default: false
      t.boolean  "sent",        default: false
  end
  </code></pre>
  
  <p>After user creates article, <code>published</code> and <code>sent</code> are false. In article properties user has "Send" button. After he clicks that button, <code>published</code> is still false but <code>sent</code> is now true.  Now in admin control panel, admin sees new article and when he clicks button "Publish", both <code>published</code> and <code>sent</code> are now true. User who uploaded article can remove article and set <code>published</code> to false.</p>
  
  <p>All actions I am doing for example like this:</p>
  
  <pre><code>&lt;%= link_to 'Undo sent', article_path(article, :article =&gt; {:sent =&gt; false}), :method =&gt; :put %&gt;
  </code></pre>
  
  <p>The problem is I don't know how to limit access. Regular user can change column <code>sent</code> to true and false but column <code>published</code> he can only change to false. Only admin can change column <code>published</code> to true and false.</p>
  
  <p>How can I accomplish that inside my controller so it could be secure? All users have role column which I can access. Thank you.</p>