Ruby on Rails

The application I am working on is largely based on Michael Hartl's tutorial.
The create action for the users controller uses strong parameters with permitted parameters. The 'admin' attribute, for instance, is not included in the permitted parameters, so a malicious user could not send a PATCH request in order to become admin.

My application requires newly created users to make a list of choices on the home page in order to be redirected to a new page, reserved for users who have completed this stage.
I thought to add to the User model a new attribute ('member', for instance) which can be toggled inside the create action of the Choice controller (probably with a call of a private method), once the user has completed the number of choices requested.

Is this allowed or am I required to revise strong parameters with the new attribute?