again, this looks like it could be handled by cancan ..