The abilities represent a set of actions. For example, the project administrator. In the project administration, you can create users, create components, etc.
In the configuration view you can create, update and remove this abilities.
And associate the rules to this abilities.
Now, you can create rules for your own status if you have a custom status.
You can put negative points and penalize some rules.