cancan - How to

class Ability
  include CanCan::Ability
  
  def initialize(user)
    user ||= User.new # guest user
    
    if user.role? :admin
      can :manage, :all
    else
      can :read, :all
      can :create, Comment  # for CommentController
      can :update, Comment do |comment|
        comment.try(:user) == user || user.role?(:moderator)  # This syntax is used to allow users to only update their own comments, unless they are the all-mighty-powerful moderator.
      end
      cannot :delete, Comment
      if user.role?(:author)
        can :create, Article  # for ArticleController
        can :update, Article do |article|
          article.try(:user) == user
        end
      end
    end
  end
end

can [:read, :create, :update], Comment
can :read, [Comment, Article]
can [:read, :create], [Comment, Article]
can :manage, Article   # allows user to perform all actions in the ArticleController

load_and_authorize_resource

# comments_controller.rb possibility -- This is showing what you would put in a comments controller 
# that is nested under an article controller.  Or you can keep them separate and they both just use
# load_and_authorize_resource.
# load_and_authorize_resource :nested => :article

<p>
  <% if can? :update, @article %>
    <%= link_to "Edit", edit_article_path(@article) %> |
  <% end %>
  <% if can? :destroy, @article %>
    <%= link_to "Destroy", @article, :method => :delete, :confirm => "Are you sure?" %> |
  <% end %>
  <%= link_to "Back to Articles", articles_path %>
</p>
...
<p>
  <% if can? :update, comment %>
    <%= link_to "Edit", edit_comment_path(comment) %>
  <% end %>
  <% if can? :destroy, comment %>
    | <%= link_to "Destroy", comment, :method => :delete, :confirm => "Are you sure?" %>
  <% end %>
</p>