Um... this is why we would use cancan to handle authorization.  Devise only handles authentication.  Please think back to previous conversations before you comment.