ability.rb

class Ability
  include CanCan::Ability

  def initialize(user)
    @user = user || User.new # for guest
    guest
    administrator if user.is_admin?
  end

  def guest
    cannot [:is_admin=], User
  end

  def administrator
    can [:is_admin=], User
  end
end