CanCan nested permissions possible?
stackoverflow.com