We typically spec mass assignment in permitted_params_spec.rb.

It has the advantage of being faster and there are also less concerns in the controller specs. If you want to ensure that permitted params is called, you could always use should_receive.