application_resource.rb

# app/models/resources/application_resource.rb
class ApplicationResource < Graphiti::Resource
  # ...
  
  ##
  # Cancancan
  ##
  def base_scope
    model.accessible_by(context.current_ability)
  end

  after_attributes do |model|
    # After attributes have been assigned to the model
    if model.respond_to?(:user_id)
      # assign the model to the current_user 
      # (if it hasn't already been assigned to a user)
      model.user_id ||= context.send(:current_user).id
    end
  end

  before_save only: [:create] do |model|
    context.authorize! :create, model
  end

  before_save only: [:update] do |model|
    if model.changed?
      context.authorize! :update, model
    end
  end

  before_destroy do |model|
    context.authorize! :destroy, model
  end
  
  # ...
end