Partially reverting my last commit as ability.rb isn't doing what I thought - but basic permissions checks are still happening...just can't control which fields on memberships a user can edit...yet