I personally dislike Pundit's way of defining permissions, but as always it's a preference.

I really wanted to keep CanCan's simplicity, but add roles while cleaning abilities/policies up.