handling admin and user-lever permissions in fairly large apps

abilities.rb

module User::Abilities
  # this is included in User
  # 
  # class User < AR:B
  #   include Abilities
  # end
  #
  def can_create?( object )
    admin? ||
      case object
      when Certification, Membership, etc.
        object.physician == self.physician
      when Physician
        object.email == self.email
      else
        false
      end
  end

  def can_read?( object )
    admin? ||

      case object
      when User
        object.id = self.id
      end ||

      true
  end

  def can_update?( object )
    admin? ||
      case object
      when Certification, Membership, etc
        object.physician == self.physician
      when Physician
        object.email == self.email
      else
        false
      end
  end
end

memberships_controller.rb

class MembershipsController
  # POST /memberships
  # POST /memberships.json
  def create
    @membership = Membership.new(membership_params)

    if !current_user.can_create?(@membership)
      go_away
    elsif @membership.save
      # render whatever
    else
      # render whatever
    end
  end

  # PATCH/PUT /memberships/1
  # PATCH/PUT /memberships/1.json
  def update
    if !current_user.can_update?( @membership )
      go_away
    elsif @membership.update(membership_params)
      # render whatever
    else
      # render whatever
    end
  end
end