We do for all models, authorization is done on controller level (where we can distinguish between clone and create actions for example). So first checking is done by ```ApplicationController#authorize``` before_filter that checks whether user has permission for particular action and second takes effect when ```.authorized(permission)``` scope is called.

However compute profiles were added during work on this PR (actually got there during rebase) so I missed it. I fix permissions for this resource and modified it to use new permission system. (add Authorizable module etc). It will be included in next commit.