Exercise 2: An Absence, Not a Placeholder — Possible Solution
====================================================================

WHAT'S CURRENTLY MISSING FROM update_title
------------------------------
Per this chapter, update_title has no before_action :authenticate_admin! filter, so the action currently runs for any request regardless of whether the requester is logged in - deliberately, matching the same gap every sibling course left open in its own Chapter 8, to be closed in Chapter 9.

WHY RAILS' VERSION OF THE GAP LOOKS STRUCTURALLY DIFFERENT
------------------------------
Per this chapter, Laravel's FormRequest has a dedicated authorize() method whose entire job is a permission decision - right now it visibly returns true, a real line of code standing in for a real check. Rails' Strong Parameters has no equivalent authorization method at all; permit only ever decides which fields are allowed, never who is allowed to submit them. Because Rails treats those as genuinely separate concerns, normally joined by a completely separate before_action filter, the current gap isn't a placeholder value sitting in an existing method - it's simply the absence of that separate filter altogether, closer in shape to Django's own missing decorator than to Laravel's visible return true;.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly identifies the missing before_action :authenticate_admin! filter as the gap, and correctly explains why Rails' structural separation between field-permitting and authorization makes this an absence rather than a visible placeholder the way Laravel's authorize() is.