I actually just recently thought about a solid concept for this myself. You want to look at $SAFE
, rubys tainting mechanisms and learn all about the security implications of eval()ing ruby code, if you plan on allowing the user to write their plugins in ruby.
If you trust your users to the point of confidently allowing them to do this, that is.
There are also many resources (gems, articles, do the googling) on sandboxing in Ruby - you should evaluate for yourself how practicable and/or safe these are.
If you do not trust the user at all, you should look into writing your own DSL in ruby or implementing other means of expressing functionality without executing user submitted code directly.
Doing something like this properly is no easy task.