Why not just use CanCan's authorize_resource stuff? Having a hash makes it harder to read this.