Install Pundit and add UserPolicy

app/policies/user_policy.rb

@@ -0,0 +1,29 @@
+class UserPolicy < ApplicationPolicy
+  def index
+    user.admin?
+  end
+
+  def show?
+    user.admin? || user.id == record.id
+  end
+
+  def new?
+    user.admin?
+  end
+
+  def create?
+    user.admin?
+  end
+
+  def edit?
+    user.admin? || user.id == record.id
+  end
+
+  def update?
+    user.admin? || user.id == record.id
+  end
+
+  def destroy?
+    user.admin?
+  end
+end