Used pundit to define role authorization policy