Is there a 'declarative' way to authorize which attributes of a model can be changed?
===

The use of attr_accessible isn't quite sufficient as it is either on or off. 

Some models have user forms, and also admin forms. For the admins the attributes they need to be able to mass-assign need to be in attr_accessible, but that means that a normal user could inject those params maliciously. It seems like a lot of work to manually assign everything on the admin side, and attr_accessible to those attributes that normal users can alter. 

Is there a rails-centric standard solution to this issue? Maybe a gem?

I envision something like this:

    model.update_attributes_with_user(params[:model], user)