@raydavis , Good catch. But this is actually used. [CanvasCourseAddUserController#authorize_adding_user uses](https://github.com/redconfetti/calcentral/blob/CLC-2949-add-admin-support/app/controllers/canvas_course_add_user_controller.rb#L12) this indirectly by passing the canvas_course object, and : can_add_users? symbol to the #authorize method.

Pundit's [#authorize method](https://github.com/elabs/pundit/blob/master/lib/pundit.rb#L62) retrieves the "policy" for the Canvas::Course object, which is defined by this Canvas::CoursePolicy class. #can_add_users? is called within the policy in relation to the @user object initialized in the Canvas::CoursePolicy object.