user.rb

class User < ActiveRecord::Base
  
  attr_protected :staff
  
end

users.rb

class Users < Application
  # === Option 1 ===
  def create
    @user = User.first
  
    User.allow_access(:staff) do
      @user.update_attributes :staff => true
    end
  end

  # === Option 2 ===
  def create
    @user = User.first
    @user.update_attributes protected_user_params(params[:user])
  end
end