Setting User priveledges using declarative auth

I'm trying to decide on the privileges for my moderator role.

All he should be able to do is to send messages to all users subscribed to his channel and to modify the page for it.

Here is what I have:

role :moderator do
    has_permissions_on[:message], :to=> [:index, :show, :new, :create,:edit,:update,:destroy]
    has_permissions_on[:channel], :to=> [:index, :show, :edit, :updat开发者_StackOverflowe]
  end

i would suggest first that you define some privileges like

privileges do
  privilege :crud do
    includes :show, :index, :create, :edit, :update, :delete
  end

  privilege :read_only do
   includes :show, :index
  end
end

based in what you said for example, i would check more the Authorization::Reader API for example, to allow admin to destroy messages just sent by him (unless he is able to destroy messages from other users, but it you didn't say nothing about)