# The controller action:

 def some_action
   authorize! :do_this_action, @some_object
 end

 # The spec:

 it "should work when authorized" do
   sign_in @user
   get :some_action
   response.should be_success
 end

 it "should not work when not authorized" do
   sign_in @other_user
   get :some_action
   response.should_not be_success
 end

it "should check the user can do_this_action" do
   mock(controller).authorize!(:do_this_action, some_object)
   get :some_action
 end

it "should check the user can do_this_action" do
   mock(controller).authorize!(:some_action, some_object)
   get :some_action
 end