Hmm.. I don't like mixing permission related methods with model related methods .. For example promotion_paths in the org model seems be more along,  "show me all the promotion paths this org is associated to." There is no concept of "prune it based on who the current user is or show me if he can edit it etc.."  Do you concur ?