CLC-3194 pundit auth framework for act-as system