title: How do I prevent access to records that belong to a different user
body: <p>How do I prevent accessing a specific set of records based on a session variable?</p>
  
  <p>i.e. I have a table of items with a user_id key, how do I filter access to the items based on user_id. I don't want someone to be able to access /items/3/edit unless that item has their user id against it (based on session var)</p>
  
  <p>update:
  I am using the answer suggested by @fl00r with one change, using find_by_id() rather than find() as it returns a nil and can be handled quite nice:</p>
  
  <pre><code>@item = current_user.items.find_by_id([params[:id]]) || item_not_found
  </code></pre>
  
  <p>where item_not_found is handled in the application controller and just raises a routing error.</p>