Install Pundit and add UserPolicy

app/controllers/users_controller.rb

@@ -2,15 +2,21 @@ class UsersController < ApplicationController
   before_action :set_user, only: %i[ destroy edit show update ]
 
   def index
+    authorize :user
+
     @title = "All users"
     @users = User.all
   end
 
   def edit
+    authorize @user
+
     @title = "My settings"
   end
 
   def update
+    authorize @user
+
     if @user.update(user_params)
       redirect_to contests_path
     else
@@ -19,15 +25,21 @@ class UsersController < ApplicationController
   end
 
   def show
+    authorize @user
+
     redirect_to edit_user_path(@user)
   end
 
   def new
+    authorize :user
+
     @title = "New user"
     @user = User.new()
   end
 
   def create
+    authorize :user
+
     @user = User.new(user_params)
     if @user.save
       redirect_to users_path
@@ -38,6 +50,7 @@ class UsersController < ApplicationController
   end
 
   def destroy
+    authorize @user
   end
 
   private