Minimal authorization through OO design and pure Ruby classes