How would you prevent other users from editing a object, say a profile object that does - not - belong to themselves?
Most online examples are complexes with multiple us
Give something like this a try....
can :update, Profile, :user_id => user.id