Authorisation is always an issue, have to be dealt carefully and often you start off with simple home made statements like user.admin?, etc. … I had to switch from a custom solution to a solid community proofed and backed solution. Find here my synopsis on testing Pundit with Rspec.