I think the paste was mistaken, it's "only call if `self.class.action_on_unpermitted_parameters` is set. See rails/rails@16e0c8816c4c8a9fb5292278bf5753b026c1105c