[50588851] cancan's ability definition/usage

Signed-off-by: Henry Chen <hchen@vmware.com>