title: Rails, ActiveAdmin, Cancancan: how to prevent access to a resource in /admin?
body: <p>I am very new to Rails (6.1.4). I tried to follow the beginner's tutorial and it worked quite well.</p>
  <p>Then I tried to adapt a bit to my own goal which is to simply perform CRUD actions on &quot;laboratoires&quot;. It worked well either.</p>
  <p>Then I wanted to try ActiveAdmin with Devise and Cancancan with this &quot;laboratoires&quot; little application.</p>
  <p>I was very impressed to see how simple it was to install and make it work. But then I realised that each user, whatever one's role (I have admin role, referent role and consultation role) can access to /admin/laboratoires.</p>
  <p>I would like that only users with admin role could access /admin/laboratoires. The other users should only access /laboratoires.</p>
  <p>I thought that I could simply complete my ability.rb model with a cannot line, this way (I tried on referent role):</p>
  <pre><code># frozen_string_literal: true
  class Ability
    include CanCan::Ability
  
    def initialize(user)
      user ||= User.new # guest user (not logged in)
  
      if user.admin_role?
        can :manage, :all 
     
      elsif user.referent_role?
        can [:read, :create, :update, :destroy], Laboratoire
        cannot [:read, :create, :update, :destroy], ActiveAdmin::Page, name: &quot;Laboratoire&quot;, namespace_name: &quot;admin&quot; 
      
      elsif user.consultation_role?
        can [:read], Laboratoire
    
    end
  
  end
  </code></pre>
  <p>But it doesn't seem to work and it seems I don't understand something here.</p>
  <p>Does anyone know what I wrote wrong? Maybe I need to provide some other informations but I am not sure yet to precisely understand which ones are relevant, to say it simply...</p>
  <p>====
  UPDATE 2021-08-05 :
  Well, I actually think I have just found the answer to my own question. I think I got confused between authorization and authentication. I just realised the ActiveAdmin's parameter  config.authentication_method can help me to handle this point. So I wrote a method in the application controller that ActiveAdmin call through this parameter to prevent non admin users to access ActiveAdmin. It seems to work perfectly well now :).</p>