cancan ability define (initial)
sometime too deep is good (my thought)
define current ability in controller
rescue when someone try to break the authorization rule
implement cancan with rails 4
Story can be created