diff --git a/lib/cancan/rule.rb b/lib/cancan/rule.rb
index fb5a452..5382b4b 100644
--- a/lib/cancan/rule.rb
+++ b/lib/cancan/rule.rb
@@ -97,7 +97,12 @@ module CanCan
     end
 
     def matches_attribute?(attribute)
-      @attributes.nil? || attribute.nil? || @attributes.include?(attribute.to_sym)
+      # don't consider attributes in a cannot clause when not matching - this can probably be refactored
+      if !@base_behavior && @attributes && attribute.nil?
+        false
+      else
+        @attributes.nil? || attribute.nil? || @attributes.include?(attribute.to_sym)
+      end
     end
 
     # TODO deperecate this
diff --git a/spec/cancan/ability_spec.rb b/spec/cancan/ability_spec.rb
index f7818a3..3617865 100644
--- a/spec/cancan/ability_spec.rb
+++ b/spec/cancan/ability_spec.rb
@@ -345,6 +345,7 @@ describe CanCan::Ability do
     @ability.can?(:update, :books, :author).should be_false
   end
 
+
   # Hash Association
 
   it "checks permission through association when hash is passed as subject" do