application_controller.rb

  def current_ability
    @current_ability ||= Abilities::Factory.ability_for(self.class, current_user)
  end

  rescue_from CanCan::AccessDenied do |exception|
    respond_to do |format|
      format.jsonapi { render jsonapi: { meta: { error: exception.message } }, status: :forbidden }
      format.json { head :forbidden, content_type: 'text/html' }
      format.html { redirect_to main_app.root_url, notice: exception.message }
      format.js   { head :forbidden, content_type: 'text/html' }
    end
  end