controller.rb

class UnApprovedActions < ApplicationController
  def approve_action
    Action.find_by(token: params[:token], *other stuff*).run_action
    
  end
end

migration.rb

class UnApprovedActions < ActiveRecord::Migration[5.0]
  def change
    create_table :un_approved_actions do |t|
      t.references :imageable, polymorphic: true, index: true
      t.string :action, allow_nil: false
      t.references :users, allow_nil: false
      t.string :token, index: true, uniq: true, allow_nil: false
      t.timestamps
    end
  end
end

models.rb

class UnApprovedActions < ApplicationRecord
   belongs_to :holder, polymorphic: true
   validates_presence_of :holder, :action, :user, :token
  
  def run_action
    whitelist_classes %w{invoices, quotes} #think about classname with Caps etc
    if whitelist_class.includes?(holder_type)
      holder.public_send(action)
    end
  end
end