How does cancancan set the model instance, and how can I inspect it?

Question

I noticed users could access an action they shouldn\'t be able to access.

I debugged in the rails console with something like