Devise has been further intergrated with the user_id matching the book that it uploads. There is a before_filter on the controller so that all actions require a sign in. The next step is to limit access for each user to only see only the books that belong to them. Can Can maybe an option but I believe this feature can be enforced with devise alone.