This doesn't really protect your case though... For example in the request:

```
http://localhost:3000/users?test[value]=hi
```

Then you would probably do something like:

```ruby
params.permit(:test).permitted? #=> returns true, still passes the hash through.
```