Usually a bang (!) method implies "Careful, this will change the state of this object"  It doesn't look like that's what this method does. 

Also the reverse logic is bit hard to process.  This is saying "unless the current user ID is the same as the resource ID, return Denied", which is the same as "IF the current user is NOT the resource user THEN return denied."  That may be easier to understand, but I don't have the context you do.

Did you want a default 'access_allowed' return at the bottom? Or are you doing some kind of check like `unless require_patient!(resource) == access_denied`?