The `strong_parameters` gem modifies the `ActionController::Parameters` object to respond to the method `#permitted?`. When `ActiveModel::ForbiddenAttributesProtection` is mixed into a model it will check if the parameters are permitted before doing assignment. The strong parameters approach works by whitelisting, so by default the parameters are not permitted.

I'd like to mix this into all models, but doing so means we'd need to go through all our admin controllers to set up appropriate permitted parameters. That falls under the "we need to do more attribute protection across the app" note in the pull request.