Why raw params can't reach .new

The safeguard two courses named

ActiveRecord: creating records and ActionController: actions both named article_params as the safe stand-in for raw params without building it. Here's what happens without it:

raw = ActionController::Parameters.new(title: "Hello Rails", admin: true)
Article.new(raw)
# ActiveModel::ForbiddenAttributesError

Rails raises right away. In a real request, params arrives as an ActionController::Parameters object, not a plain Ruby Hash, and that object starts out unable to be mass-assigned.

permitted? is the actual flag

raw.permitted?
# => false

Every ActionController::Parameters object carries this flag. .new checks it and refuses when it's false. The flag is an explicit switch that always starts off; Rails doesn't guess whether a hash looks dangerous.

Why the default is "no"

params holds whatever the request carried, which can include more than the form's visible fields, the concern ActiveRecord: creating records raised. With permitted? starting at false, a developer must decide what's allowed through (lessons 2 and 3) instead of trusting everything by accident.

Key takeaways

• Raw params passed to .new raises ActiveModel::ForbiddenAttributesError.
• permitted? is false by default, and .new checks it.
• The false default forces a deliberate choice of what's allowed.