extra_charge_grounds_controller.rb

class ExtraChargeGroundsController < WithSessionController
  require_global_permission Access::P_EXTRA_CHARGE_MANAGE
end

with_session_controller.rb

 class WithSessionController < ApplicationController
   class << self
     private
     
     def require_global_permission(permission, **opts)
       before_action :forbid!, **opts, unless: ->{
         CurrentSession.context_by_permission(permission)[Access::Context::GLOBAL]
       }
     end
   end
   
   private
   
   def forbid!
     raise ForbiddenError
   end
 end