This would add two acos 'User' and 'Post'. But now you think if Acos is controller then why not have 'Posts' instead of 'Post'? Good question. This is because usually a controller's action can be divided into four types of action 'create', 'read', 'update' or 'delete' which are performed on a single or group of records belonging to a model. Hence, in this approach we going at record level Access Control. We want to make sure whether the current Aro (a User) has access to do 'C', 'R', 'U' or 'D' action on the Aco ( a record for eg. A post). If yes, then let him do the action otherwise don't. Now the code, that shows you the manual way to create aros and acos as discussed above.