The `cancan` gem also handles roles and permissions. I haven't used it before.