create polymorphic model Assignment
set up owner's permissions
authrize controllers