Add authorization policies with Pundit