ability.rb

class Ability
  include CanCan::Ability

  def initialize(user)
    # ...

    can :perform, EventStatusChange do |status_change|
      user.admin? || ["pending approval"].include?(status_change.new_status)
    end

    # ...
  end
end

event_status_change.rb

class EventStatusChange
  attr_reader :event, :new_status

  def initialize(event, new_status)
    @event      = event
    @new_status = new_status
  end
end

events_controller.rb

class EventsController < ActionController::Base
  load_and_authorize_resource

  def update
    # UGH!
    if @event.status != params[:event][:status]
      unless current_user.admin? || ["pending approval"].include?(params[:event][:status])
        render status: :unauthorized and return
      end
    end

    # ...
  end
end

events_controller_with_can_can.rb

class EventsController < ActionController::Base
  load_and_authorize_resource

  def update
    if @event.status != params[:event][:status]
      authorize! :perform, EventStatusChange.new(@event, params[:event][:status])
    end

    # ...
  end
end

Interesting approach, thanks for sharing.