How can I validate that a user (who owns a company that may have products) can create / add a product to the company?

Question

I use defineAbility to give the user the "Ability" can(\'create\', \'Product\').

However, a Product belongs to a