class Blah < ApplicationController
  access_control do
    default :deny

    allow anonymous                   # аналогично allow nil  - пустить анонима
    allow :admin                      # проверяет по глобальной роли
    allow :creator, :of => Ruby       # проверяет по роли на класс
    allow :employed, :by => :company  # current_user.has_role? :employed, @company
    allow do
      current_user.has_role?('lover', Dog) && current_user.has_role?('hater', Cat)
    end

    # аналог того что выше
    allow possessor_of_several_roles do
      role :lover, :of => Dog
      role :hater, :of => Cat
    end

    allow :known_guy, :to => :index
    allow :owner, :of => :site, :to => [:update, :delete, :destroy]

    allow anonymous, :except => [:edit, :delete, :update, :destroy, :new]

    actions :index, :show do
      allow :secretaries
    end

    actions :edit, :new, :update, :destroy, :delete do
      allow :admins
    end
  end
end