Lines 9-11 make me happy :-)

ability.rb

class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new # guest user (not logged in)
    if user.admin?
      can :manage, :all
    elsif user.manager?
      can :manage, Client, Client.where(:user_id => user.id) do |client|
        client.user_id == user.id
      end
    else
      can :read, :all
    end
  end

end