This works, but another option is to start creating different Ability classes for different contexts (e.g. OrderDetailAbility). That way we don't have to keep cramming all permissions into one fat class. It's a cleaner approach, but might not be easier. Something to consider.