Design / Implement a real authorization system

Using a gem like 'cancan', or something from scratch, build a sane / coherent authorization system.