protected_fields.rb

# Module
# ------

module ProtectedFields
  # There is probably a nicer way to do this...
  def self.included(base)
    base.class_eval {
      def self.protected_attributes(attrs = [])
        @@protected_attributes = attrs
      end
    }
  end

  def protect_from(user)
    @protected = true
    @user = user
    self
  end

  before_save do
    if @protected
       # check fields against user
    end
  end
end

protected_record.rb

# Model
# -----

class Visit < ActiveRecord::Base
  include ProtectedFields

  protected_attributes :visit_date, :name
end

visits_controller.rb

# Controller
# ----------

def update
  @visit = Visit.find(params[:id]).protect_from(current_user)

  if @visit.update_attributes(params[:visit])
    # Success
  else
    # Failure
  end
end