Yeah, you should use pundit policies to scope data