Restrict actions in TicketsController based on permissions and hid links