title: CanCan - How to allow users to update and delete only their own objects
body: <p>I've started a Rails application with Devise and CanCan. I have users which has a one-to-many relationship to articles. I'm new to CanCan, here's what I'm planning to do:</p>
  
  <p><strong>Admin</strong></p>
  
  <ul>
  <li>can do any action on articles</li>
  </ul>
  
  <p><strong>Logged in user</strong></p>
  
  <ul>
  <li>can read and create articles</li>
  <li>can edit and destroy his own articles</li>
  </ul>
  
  <p><strong>Guest user</strong></p>
  
  <ul>
  <li>can read articles</li>
  </ul>
  
  <p>But I'm having trouble understanding the syntax of CanCan. I understand it would be something like this.</p>
  
  <pre><code>def initialize(user)
    user ||= User.new
    if user.admin?
      can :manage, Article
    else
      can :read, Article
    end
  end
  </code></pre>
  
  <p>But this is just for the admin and guest user, I'm not sure how to differentiate a guest user from a logged in user because it creates a new User object when user is empty. I've seen that the code should be something like this <code>can [:edit, :destroy], Article, :user_id =&gt; user.id</code>, but I'm not sure how this would fit in the initialize method.</p>
  
  <p>And one last question, if I only define a <code>can :read, Article</code> on guests, would it block the other actions such as create and update, like white listing the read action?</p>
  
  <p>Any help would be appreciated. Thanks a lot!</p>