Most popular Rails authorization gem. Provides Plain-Old-Ruby policy classes paired with resources, where each instance method is a permission check; used from controllers and views. Scales better than CanCan but, per Yatish Mehta's wroclove.rb 2025 talk, struggles as apps grow: refactoring is risky because there is no automated way to find upstream/downstream permission dependencies; performance suffers from intermediate object loading and N+1 queries; permission results cannot be cached between requests because logic is a black box; and there is no way to audit why a user was or was not allowed, nor to perform reverse lookups (which users can act on a resource). Meedan adopted Pundit when they first built Check with GraphQL, because graphql-ruby did not yet offer authorization at the API layer.