Should go through the access policy you made above, e.g. `AccessPolicy.require_action_allowed!(:create, current_user, @application_user)`.