I've a controller without model. In this controller we are loading some other resources. Most importantly the application has multi-tenancy feature.

Here is the code:

```
# ability.rb
class Ability
  include CanCan::Ability

  def initialize(user)
    if user.owner?
      can :manage, Tool, tenant_id: user.tenant.id
    end
  end
end

# boxes_controller.rb
class BoxesController < ApplicationController
  authorize_resource class: false

  def index
    tools = Tool.all
  end
end

```

What is the problem?:
---------------------

Say, `user1` of `tenant1` creates `tool1` and the `user2` of `tenant2` creates `tool2`.

The problem is, from `tenant1`, `user1` can access `tool2`! :(

Did I wrote anything wrong? Please help.