Actually, I prefer not. Giving them :manage makes them authorized for actions like "Send broadcast email" or "Refund money" even if they are not for their class. Ofcourse, I can make in such tasks if tree with if authorized? and if bindings[:something].some_action, but we should prefer whitelist attitude,not blacklist. So in my opinion it's better without manage.