ruby on rails - Can't grant permission on class scoped to belongs_to association -

i have courseclass model has many attendancesheets , has_many teachers. want teacher(s) of course_class instance able manage course_class's attendance sheets.

i'd expect following set up:

if user.has_role? :teacher   can [:manage], attendancesheet, course_class: { teachers: {id: user.id } } end 

users have global roles, can have per-instance roles on courseclass. above, in theory, should check have global role, , teachers association finds teachers instance role on courseclass.

in controller @attendance_sheets set by:

@attendance_sheets = @course_class.attendance_sheets.all

when run ability checks following results:

[1] pry(#<#<class:0x007fb011970ea0>>)> can? :read, @attendance_sheets => false [2] pry(#<#<class:0x007fb011970ea0>>)> can? :read, attendancesheet => true [3] pry(#<#<class:0x007fb011970ea0>>)> can? :read, @course_class.attendance_sheets => false [4] pry(#<#<class:0x007fb011970ea0>>)> can? :manage, attendancesheet => true 

i expected/want read/manage on attendancesheet false , :read on @attendance_sheets or @course_class.attendance_sheets true.

thanks in advance.