authorization.rb

def human?(req)
  req[:headers][:client] != 'google'
end

def auth?(req)
  req[:params][:secret] == 'ruby'
end

def access_rules
  {uri: '/admin', handler: {and: [:human?, :auth?]}}
end

def check(req, rules)
  return if req[:uri] != rules[:uri]

  rules[:handler][:and]
    .map { |n| method(n) }
    .reduce(true) { |acc, m| acc && m.call(req) }
end

req1 = {uri: '/admin', headers: {client: 'google'}}
req2 = {uri: '/admin', headers: {client: 'safari'}, params: {secret: 'ruby'}}

check(req1, access_rules)       # => false
check(req2, access_rules)       # => true