Calling permit! bypasses strong parameter filtering and allows assignment of any attribute.
Explicitly permit only the required attributes with permit(:a, :b).