You should also do a load_and_authorize_resource of your parent model in the codes controller:
load_and_authorize_resource :company
followed by loading your code resource through your company:
load_and_authorize_resource :company
load_and_authorize_resource :code, through: :company
I don't see any added value in your before_filter, as this is exactly what CanCan will do for you...