From https://once.com/writebook

app/models/concerns/authorization.rb

@@ -0,0 +1,10 @@
+module Authorization
+  private
+    def ensure_can_administer
+      head :forbidden unless Current.user.can_administer?
+    end
+
+    def ensure_current_user
+      head :forbidden unless @user.current?
+    end
+end