I think you still need ```Application.includes(:domain).accessible(current_user).where(owner: current_user)``` in order to get scoped access applied correctly (if the user is authenticated via a token which doesn't allow application visibility)