Ahhh, I poked around a bit in ability.rb. I think I understand cancan better.