Make projects only visible to users with permission to see them (page 267)
Don’t show projects that a user doesn't have permission to see (page 272)
Restrict reading tickets to correct project scope (page 275)
Restrict creating tickets to only users who have permissions to do it (page 282)
Restrict ticket updating to only those who have permission (page 286)
Restrict destroy action to only people with permission (page 289)
Restrict actions in TicketsController based on permissions and hide links (page 295)