Fat models, skinny controllers

Keep controllers thin - they should only:
- Authenticate and authorize
- Parse params and set instance variables
- Call model/service methods
- Render response

Business logic belongs in:
- Models (for single-model operations)
- Service objects (for multi-model operations)
- Form objects (for complex form handling)
- Query objects (for complex queries)

```ruby
# Good: Thin controller
def create
@order = OrderCreator.new(order_params, current_user).call
respond_with @order
end
```