Cancan abilities: admin can manage all, employee can read all.