title: How to get CanCan to only allow user to view their own profile in Rails?
body: <p>In <code>ability.rb</code> I have the following statements:</p>
  
  <pre><code>if user.is_employee?
    can :schedule, Employee, id: user.employee.id
  end
  </code></pre>
  
  <p>This should allow employees to view their own schedule at <code>/employees/273/schedule</code>. That URL will work if the employee's id is 273. This works... an employee is able to view that URL. The problem is employees can view <strong><em>all</em></strong> other ids as well. Shouldn't the above limit employees to only schedule their own id?</p>
  
  <p><em><strong>UPDATE</em></strong>: Here's my <code>EmployeeController</code>:</p>
  
  <pre><code>class EmployeeController &lt; ApplicationController
    before_filter :authenticate_user!
    authorize_resource
    def schedule
      @employee = Employee.find(params[:id])
    end
  end
  </code></pre>