Hi Ryan,

I just found a nasty problem when you have multiple definitions for a nested ability, the can? method always return true. For example :

# ability.rb
can :read, Comment, :post => {:published => true}
can [:read, :update], Comment, :post => {:author_id => user.id}

# checking ability
can? :read, @post => Comment

I found out that the rule.rb class is using Hash.shift on the subject. Doing that removes the content from the subject. So when the second rule is tested the subject is empty and the condition matching return true.
In this commit, I simply propose to replace Hash.shift by Enumerable.first as it's not destructive on the subject Hash.

Florent