title: CanCan: limiting a user's ability to set certain model attributes based on their role
body: <p>I have a <strong>Post</strong> model with a <code>:published</code> attribute (<em>boolean</em>) and a <strong>User</strong> model with a <code>role</code> attribute (<em>string</em>). There are three roles: <code>ROLES = %w[admin publisher author]</code></p>
  
  <p>I don't want users whose role is <strong>author</strong> to be capable of setting, <em>or editing</em>, the <code>:published</code> field on the Post model.</p>
  
  <p>I'm using CanCan (and RailsAdmin gem) and my simplified Ability.rb file looks like this:</p>
  
  <pre><code>class Ability
    include CanCan::Ability
    def initialize(user)
      user ||= User.new
  
      if user.role? :admin
        can :manage, :all
      elsif user.role? :publisher
        can :manage, Post
      elsif user.role? :author
        # I want to prevent these guys from setting the :published attribute
      end
  
    end
  end
  </code></pre>
  
  <p>Anyone got any tips for doing this sort of thing?</p>