diff --git a/Gemfile b/Gemfile
index 897dd45..bb31e8a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -18,6 +18,8 @@ gem 'graphiql-rails', '~> 1.4.1'
 
 gem 'uglifier'
 
+gem 'bcrypt'
+
 group :development, :test do
   # Call 'byebug' anywhere in the code to stop execution and get a debugger console
   gem 'byebug', platform: :mri
diff --git a/Gemfile.lock b/Gemfile.lock
index be02e6d..c2add28 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -39,6 +39,7 @@ GEM
       minitest (~> 5.1)
       tzinfo (~> 1.1)
     arel (7.1.4)
+    bcrypt (3.1.11)
     builder (3.2.3)
     byebug (9.0.6)
     concurrent-ruby (1.0.4)
@@ -134,6 +135,7 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  bcrypt
   byebug
   graphiql-rails (~> 1.4.1)
   graphql (~> 1.4.3)
diff --git a/app/models/film.rb b/app/models/film.rb
index 60d69bf..6ecf05d 100644
--- a/app/models/film.rb
+++ b/app/models/film.rb
@@ -8,4 +8,7 @@ class Film < ApplicationRecord
     join_table: 'films_people',
     foreign_key: 'film_id',
     association_foreign_key: 'person_id'
+
+  has_many :ratings
+  has_many :critics, through: :ratings, source: :user
 end
diff --git a/app/models/rating.rb b/app/models/rating.rb
new file mode 100644
index 0000000..c9ac3c4
--- /dev/null
+++ b/app/models/rating.rb
@@ -0,0 +1,6 @@
+class Rating < ApplicationRecord
+  belongs_to :user
+  belongs_to :film
+
+  validates_inclusion_of :number, in: 0..5
+end
diff --git a/app/models/user.rb b/app/models/user.rb
new file mode 100644
index 0000000..e16c703
--- /dev/null
+++ b/app/models/user.rb
@@ -0,0 +1,5 @@
+class User < ApplicationRecord
+  has_secure_password
+  has_many :ratings
+  has_many :rated_films, through: :ratings, source: :film
+end
diff --git a/db/migrate/20170212195638_create_ratings.rb b/db/migrate/20170212195638_create_ratings.rb
new file mode 100644
index 0000000..c97432d
--- /dev/null
+++ b/db/migrate/20170212195638_create_ratings.rb
@@ -0,0 +1,17 @@
+class CreateRatings < ActiveRecord::Migration[5.0]
+  def change
+    create_table :users do |t|
+      t.string :name
+      t.string :email
+      t.string :password_digest
+      t.timestamps
+    end
+
+    create_table :ratings do |t|
+      t.belongs_to :user, index: true
+      t.belongs_to :film, index: true
+      t.integer :rating
+      t.timestamps
+    end
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index adce7bd..6ea8d94 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20170211182808) do
+ActiveRecord::Schema.define(version: 20170212195638) do
 
   create_table "films", force: :cascade do |t|
     t.string   "title"
@@ -103,6 +103,16 @@
     t.datetime "updated_at",      null: false
   end
 
+  create_table "ratings", force: :cascade do |t|
+    t.integer  "user_id"
+    t.integer  "film_id"
+    t.integer  "rating"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["film_id"], name: "index_ratings_on_film_id"
+    t.index ["user_id"], name: "index_ratings_on_user_id"
+  end
+
   create_table "species", force: :cascade do |t|
     t.string   "name"
     t.string   "classification"
@@ -137,6 +147,14 @@
     t.datetime "updated_at",             null: false
   end
 
+  create_table "users", force: :cascade do |t|
+    t.string   "name"
+    t.string   "email"
+    t.string   "password_digest"
+    t.datetime "created_at",      null: false
+    t.datetime "updated_at",      null: false
+  end
+
   create_table "vehicles", force: :cascade do |t|
     t.string   "name"
     t.string   "model"
diff --git a/test/fixtures/ratings.yml b/test/fixtures/ratings.yml
new file mode 100644
index 0000000..dfaf058
--- /dev/null
+++ b/test/fixtures/ratings.yml
@@ -0,0 +1,4 @@
+good-rating:
+  user: test-user
+  film: a-new-hope
+  rating: 5
diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml
new file mode 100644
index 0000000..0d210b9
--- /dev/null
+++ b/test/fixtures/users.yml
@@ -0,0 +1,3 @@
+test-user:
+  name: xuorig
+  password_digest: <%= BCrypt::Password.create('averysecurepassword', cost: BCrypt::Engine.cost) %>