This is a broken check because the Ability file grants `:manage` on a user's self, so this is always true if the user is logged in. You probably want `authorize! :claim_prize, @prize_provider`, which is actually automatically achieved by `load_and_authorize_resource`, so you can probably just delete this line.