`form_for [@user, @proof, @requirement]` can work if you set routes: 
````ruby
resources :users do
  resources :proofs do
    resources :requirements
  end
end
````
Which is bad practice as well and not very logical.
I think we need to think about a real case here.
A user registers an account and submits a proof for a given PCI requirement.
A malicious user wanting to steal the proof submitted by the previous user would need to edit that proof record and in order to do that he would have to edit the proof user_id attribute.

By nesting the proof resource in the user resource Rails expects the current_user to be the "owner" of the proof (his .id should be identical to the proof.user_id) in order to be able to edit it.
The proof.standard_id which is set by a hidden_field is easy to change with simple tools which alter the field value before submitting the form, but I can't see any negative consequences of this action. A proof is valid for a given standard only (correct me if I'm wrong).