This says "ability can claim_prize on any instance of PrizeProvider". That means that anybody can claim a prize at any time, even if not logged in, which doesn't seem to make much sense. You need to either add a conditions hash (preferable, if possible) or a callback block for validating permissions.