01-agencies_controller.rb

class AgenciesController < ApplicationController
  before_filter :require_user

  def show
    @agency = Agency.find(params[:id])

    forbid unless current_user.admin_of_agency?(@agency)
  end

end

02-user.rb

class User < ActiveRecord::Base

  has_many :administered_agencies, through: :agency_admins, source: :agency
  has_many :agency_admins

  def admin_of_agency?(agency)
    system_admin? || administered_agencies.include?(agency)
  end

end