This switching has more to do with context than with permissions. This AccessoriesController is used in two separate contexts based on the routes. The facility manager-side is only adding accessories that haven't already been added to the order. When on the user side, they should see all accessories including the ones they've already added.