authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
I can imagine that users can be joined with instance_user,  the thing is how we can find current_course_user ? we do all these queries and joins inside ability class?