ability.rb

class Ability
  include CanCan::Ability

  def initialize(user, *args)
    super(*args)
    alias_action :new, to: :write
    alias_action :create, to: :publish
    user ||= User.new # guest user (not logged in)
    if user.has_role? :admin
      can :manage, :all
    else
      user.has_role? :user
      can :manage, User, user_id: user.id
      #As a user you can read a widget which you have permissions for..
      can :read, Widget do |widget|
        user.permissions.where(widget_id: widget.id).exists?
      end
      can :manage, :all
    end
end 

notes.rb

undefined method `widget_id' for #<ActiveRecord::Relation:0x00000004e646b0>
=>       can :read, Widget, widget_id: user.permissions.widget_id

=begin 
Associations are as followed: 

User-  has_many :widgets, through: :permissions
Permissions -   belongs_to :widget
=end