Why can't you do params[:order].permit(permitted_checkout_attributes) here and then be done with it? Why do you have to do the `permit` call in the models? Seems... uncanny to do it there.