Strictly necessary? No. Recommended by Rails? more so. Form my understanding, this is the best practice way of denoting what attributes on a model can be assigned through mass assignment operators. Our controller parameters checks are designed to prevent this by declaring and checking in-coming parameters against that list, but I don't see harm in protecting our models directly. The second issue is that the params hash comes into an API call with things like `{:action => 'create', :controller 'api/v2/products'}` which we either have to remove for every controller to prevent errors from being thrown or use `attr_accessible` on the models.