// the take
CanCan is the original Rails authorization gem that let you define all user permissions in one Ability class and check them with can?/cannot? in controllers and views. It made load_and_authorize_resource and declarative ability definitions popular, but the gem itself has been dead since 2012 and the README tells you outright to use CanCanCon or Pundit instead.
The Ability class pattern (one place for all permission logic, checked declaratively rather than scattered through controllers) is genuinely well designed and still the template every successor copies. load_and_authorize_resource for RESTful controllers removes a lot of repetitive authorize! calls. The model adapter abstraction (ActiveRecord, DataMapper, Mongoid, a default fallback) shows the core logic was cleanly separated from persistence concerns.
Unmaintained since 2012 - no Rails 4+ support, no fixes for the security issues that prompted the CanCanCan fork in the first place. Targets Rails 2/3 era APIs (config.gem, environment.rb) that don't exist in any Rails version anyone runs today. Zero chance of a CVE fix landing if one is found in your authorization layer, which is about the worst place to have unpatched code. There's no reason to pull this into a new or existing project when CanCanCon is a drop-in replacement with the same API and actual maintenance.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →