That is part of my concern with minitest.  We are essentially skipping testing the permissions on controller action.  We do need to build the infrastructure in the future if we plan to use minitest (and I have raised that as an area that we need to work); however, until it is there tests can be written in rspec for verifying rbac.  It is not a lot of code to write in rspec.