post.rb

class Post < ActiveRecord::Base
  belongs_to :user
end

posts_controller.rb

module Users
  class PostsController < ApplicationController
    # a user can only see posts he created
    def index
      @posts = posts.paginate(:page => params[:page])
      respond_with(@posts) #rails 3 goodness :)
    end

    def create
      @post = current_user.posts.build(params[:post])
      if @post.save
      # ...
      end
    end

    # same for destroy action
    def update
      @post = posts.find(params[:post_id])
      # ...
    end

    protected
    
    # returns a scope that is correct for the current user.
    # this way, a user can only access his posts
    def posts
      current_user.posts
    end
  end
end

routes.rb

map.resources :users do |users|
  users.resources :posts
end

user.rb

class User < ActiveRecord::Base
  has_many :posts
end