Restrict ticket updating to only those who have permission.
Restrict destroy action to only people with permission.
Restrict actions in TicketsController based on permissions and hide links.