rails_admin employee can only edit who is not administrator

Question

Rails 5 gens rails_admin, Devise, cancancan

I have a User model {name:string, ..., admin_role:Boolean, employee_role:Boolean, user_role:Boolean}

class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new # guest user (not logged in)
    can :read, :all                 # allow everyone to read everything
    cannot :manage, [Gender]
    return unless user.admin_role? || user.employee_role?
    can :access, :rails_admin       # only allow admin and employee users to access Rails Admin
    can :dashboard, :all            # allow access to dashboard
    if user.admin_role?
      can :manage, :all             # allow superadmins to do anything
    elsif user.employee_role?
      can :update, [User], admin_role: false
    end
  end
end

like "can :update, [User], admin_role: false" I can only "edit" those who are not administrators, but I can’t save the edit..

What I’m doing wrong?

Answer 1

can :update, [User], admin_role: false by can :Manage, [User], admin_role: false

So the rule is much more complete.