Performing access control at the highest level possible

Many security issues in Ruby web applications are due to missing authentication or authorization checks when processing a request. This is especially common in web frameworks that separate routing from request handling and use some type of conditional before hook for performing access control. Let's say you have a Rails controller that uses a before hook for access control:

class FooController < ApplicationController
  before_action :check_access
  def index
    # ...
  end
  def create
    # ...
  end
  # ...
  private def check_access
    # ...
  end
end

This is probably not likely to result in access control vulnerabilities since the access is checked for every action. However, let's say you set the before_action hook so that it's conditional, like so:

class FooController...