Pattern of the permissions

Can/cannot - specifies whether the user with that permission can do or cannot do that task.
Action - specifies the action which can be done by that model or subject like update, index, create etc. There is a special action called manage which matches every action.
Subject - specified the model like products, users etc. of which the permission is given. There is an special subject called all which matches every subject.
Attributes - specifies the attributes for which the permission is specified. Read-only actions shouldn't require this like index, read etc. But it is more secure if we specify them in other actions like create or update.

Some examples of permissions

can-manage-spree/product - can perform every action on Spree::Product but not on any other model or subject.
can-update-all - can update all models or subjects.
can-update-spree/product - can update only products, and not users, orders and other things.
can-update-spree/product-price - can update only price of products.
can-manage-all - can perform every action on all models.

<%= f.label :title, Spree.t(:permission_title) %> * <%= f.text_field :title, class: 'form-control' %> help

<%= f.label :description, Spree.t(:permission_description) %> <%= f.text_field :description, class: 'form-control', placeholder: 'This allows the permitted user to..' %>

<%= f.label :priority, Spree.t(:permission_priority) %> * <%= f.number_field :priority, in: 0..9, step: 1, class: 'form-control' %>

<%= Spree.t(:permission_priority_help) %>

<%= f.check_box :visible, value: true %><%= Spree.t(:permission_visible) %>

<%= Spree.t(:permission_visible_help) %>