The only thing I disagree for now is this line, we should specify the project attributes even for admins. With that change, I guest it should be as the example on pundit documentation, return only an array with the params and let the controller deal with the rest.