use Pundit for attributes