generate 'cancan:ability'