Install Pundit and add UserPolicy

app/controllers/application_controller.rb

@@ -1,8 +1,14 @@
 class ApplicationController < ActionController::Base
   include Authentication
+  include Pundit::Authorization
+
+  before_action :set_title, :set_current_user
+  # TODO: add later
+  # after_action :verify_authorized
+
   # Only allow modern browsers supporting webp images, web push, badges, import maps, CSS nesting, and CSS :has.
   allow_browser versions: :modern
-  before_action :set_title, :set_current_user
+  rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized
   layout "authenticated"
 
   private
@@ -14,4 +20,11 @@ class ApplicationController < ActionController::Base
   def set_current_user
     @current_user = current_user
   end
+
+  def user_not_authorized(exception)
+    policy_name = exception.policy.class.to_s.underscore
+
+    flash[:error] = t "#{policy_name}.#{exception.query}", scope: "pundit", default: :default
+    redirect_back_or_to(root_path)
+  end
 end