osem/app/models/ability.rb

class Ability
  include CanCan::Ability

  def initialize(user)
    # guest user (not logged in)
    user ||= User.new
    if user.admin? || user.organizer?
      # An admin can manage everything
      can :manage, :all
    else
      can [:update, :destroy], Event do |event|
        event.users.include?(user)
      end
      can [:create, :read], Event
    end
  end
end