updated pundit policy to be more strict