Authorization system will check automatically for one thing only "can user access desired action (content_views#show) in this case, based on permission map". This is done (in foreman at least) by calling ApplicationController#authorize before filter.

If you want to authorize specific content view (with id 1 in this case) you have to use ContentView.authorize scope (or some readable helpers you define). I think @iNecas is referring to that this scope is missing here so any user with access to that action can view any content view.

Also I'm not sure why you override #authorized instead of #authorize which handles api requests as well.