application_controller.rb

class ApplicationController < ActionController::Base
  ensure_authorization_performed :except => [:index, :search], :if => :auditing_security?, :unless => :devise_controller?

  private
  def auditing_security?
    Rails.env != 'production'
  end

  # Send 'em back where they came from with a slap on the wrist
  def authority_forbidden(error)
    Authority.logger.warn(error.message)
    redirect_to request.referrer.presence || root_path, :alert => 'You are not authorized to complete that action.'
  end
end

framework.rb

class Framework < ActiveRecord::Base
  include Authority::Abilities
  self.authorizer_name = 'InfoDatabaseAuthorizer'
end

frameworks_controller.rb

class FrameworksController < AuthenticatedController
  authorize_actions_for Framework

  def index
    @frameworks = Framework.all
  end

  def new
    @framework = Framework.new
  end
end

info_database_authorizer.rb

class InfoDatabaseAuthorizer < ApplicationAuthorizer
  def self.default(adjective, user)
    user.has_role? :admin
  end
end