If you're developing a RESTful app you may or may not allow actions for certain controllers in your routes.rb

map.resources :posts do |post|
  post.resources :comments, :only => [:index, :create]
end

Now since (dis-)allowing certain actions can be quite a sensitive part of your app it should definitely be spec'd.
Here's a simple 1-liner of how to test this in your controller specs:

it "should not allow update" do
 lambda {put :update, :id => @com.id}.should raise_error(ActionController::RoutingError)   
end