CanCan is a gobbledigook.

ability.rb

    # VERSION 1:
    can [ :create, :read, :download ], Attachment do |attachment|
      user.can? :read, attachment.attachable
    end
    can [ :update, :destroy ], Attachment do |attachment|
      user.administrator? or attachment.try( :user_id ) == user.id
    end
    
    # VERSION 2:
    can do |action, subject_class, subject|
      if subject and subject_class == Attachment
        if action == :update or action == :destroy
          user.administrator? or subject.try( :user_id ) == user.id
        end
    
        # AtoD!
        if action == :create or action == :read or action == :download
          user.can? :read, subject.attachable
        end
      end
    end
    
    # VERSION 3:
    can do |action, subject_class, subject|
      if subject and subject_class == Attachment
        can [ :create, :read, :download ] if user.can? :read, subject.attachable
        can [ :update, :destroy ] if user.administrator? or subject.try( :user_id ) == user.id
      end
    end