diff --git a/app/controllers/projects/accesses_controller.rb b/app/controllers/projects/accesses_controller.rb
index fed94ea59..19d43b778 100644
--- a/app/controllers/projects/accesses_controller.rb
+++ b/app/controllers/projects/accesses_controller.rb
@@ -6,14 +6,12 @@ class Projects::AccessesController < ApplicationController
   end
 
   def update
-    update_access
-    redirect_to project_access_url(@project)
+    @project.update_access [ Current.user, *find_users ]
+    redirect_to edit_project_access_url(@project)
   end
 
   private
-    def update_access
-      users = Current.account.users.active.find([ Current.user.id, *params[:user_ids] ])
-      users.each { |user| @project.accesses.create_or_find_by!(user: user) }
-      @project.accesses.where.not(user: users).destroy_all
+    def find_users
+      Current.account.users.active.where(id: params[:user_ids])
     end
 end
diff --git a/app/models/project.rb b/app/models/project.rb
index deb6b4d31..dc90aa588 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -1,13 +1,8 @@
 class Project < ApplicationRecord
+  include Accessible
+
   belongs_to :account
   belongs_to :creator, class_name: "User", default: -> { Current.user }
 
-  has_many :accesses, dependent: :destroy
-  has_many :users, through: :accesses
-
   has_many :bubbles, dependent: :destroy
-
-  after_create do
-    accesses.create!(user: creator)
-  end
 end
diff --git a/app/models/project/accessible.rb b/app/models/project/accessible.rb
new file mode 100644
index 000000000..394edae35
--- /dev/null
+++ b/app/models/project/accessible.rb
@@ -0,0 +1,23 @@
+module Project::Accessible
+  extend ActiveSupport::Concern
+
+  included do
+    has_many :accesses, dependent: :destroy
+    has_many :users, through: :accesses
+
+    after_create -> { grant_access(creator) }
+  end
+
+  def update_access(users)
+    transaction do
+      grant_access(users)
+      accesses.where.not(user: Array(users)).delete_all
+    end
+  end
+
+  def grant_access(users)
+    Array(users).each do |user|
+      accesses.create_or_find_by!(user: user)
+    end
+  end
+end