gistfile1.rb

  def permission?
    user = current_user
    controller = params[:controller]
    action = params[:action]
    id = params[:id]

    # Okay, the user is an administrator. Allow all access.
    return true if user.admin

    # Fine grained access rules.
    # Allow changing own profile.
    return true if controller == "users" and (action == "edit" or action == "update") and id == user.id.to_s

    # User is no admin and no access rule allowed access.
    flash[:error] = "Sorry. You must be an administrator to perform this action."
    redirect_back_or_default('/')
    return false
  end