   alias Core.Annotation
 
   plug Guardian.Plug.EnsureAuthenticated, %{handler: Core.Auth} when action in [:create, :update, :delete]
+  plug :find when action in [:update, :delete, :show]
+  plug :authorize, %{permission: "create_annotations"} when action in [:create]
+  plug :authorize_authored, %{permission: "update_authored_annotations"} when action in [:update, :delete]
   plug Core.BodyParams, name: "annotation"
-  plug :find when action in [:update, :delete, :show]
 
   def index(conn, _params) do
     annotations = Repo.all(Annotation)


    case Repo.update(changeset) do
      {:ok, annotation} ->
        render(conn, "show.json", annotation: annotation)
      {:error, changeset} ->
        conn
        |> put_status(:unprocessable_entity)

    send_resp(conn, :no_content, "")
  end

  # Allow certain users to perform actions
  #
  # It is recommended to use this function as Plug
  defp authorize(conn, %{permission: permission}) do
    user = Guardian.Plug.current_resource(conn)

    if Core.User.can?(user, permission) do
      conn
    else
      conn
      |> put_status(:forbidden)
      |> render(Core.ErrorView, "403.json", %{})
      |> halt()
    end
  end

  defp authorize_authored(conn, %{permission: permission}) do
    annotation = conn.assigns[:annotation]
    user = Guardian.Plug.current_resource(conn)

    if Core.User.can?(user, permission) and annotation.author === user.id do
      conn
    else
      conn
      |> put_status(:forbidden)
      |> render(Core.ErrorView, "403.json", %{})
      |> halt()
    end
  end


  defp find(conn = %Plug.Conn{params: %{"id" => id}}, _opts) do
    case Repo.get(Annotation, id) do
      nil ->
