Add HyperTagMethods#before_destroy to destroy all AccessTag instances referencing the receiver. I found that other than Account, the only callers of dissociate_with_projects were when calling destroy on the object. Change from overriding Firewall#destroy to #before_destroy.