     send_resp(conn, :no_content, "")
   end
 
+  # Allow certain users to perform actions
+  #
+  # It is recommended to use this function as Plug
+  defp authorize(conn, %{permission: permission}) do
+    user = Guardian.Plug.current_resource(conn)
+
+    if Core.User.can?(user, permission) do
+      conn
+    else
+      conn
+      |> put_status(:forbidden)
+      |> render(Core.ErrorView, "403.json", %{})
+      |> halt()
+    end
+  end
+
+  defp authorize_authored(conn, %{permission: permission}) do
+    annotation = conn.assigns[:annotation]
+    user = Guardian.Plug.current_resource(conn)
+
+    if Core.User.can?(user, permission) and annotation.author === user.id do
+      conn
+    else
+      conn
+      |> put_status(:forbidden)
+      |> render(Core.ErrorView, "403.json", %{})
+      |> halt()
+    end
+  end
+
+
   defp find(conn = %Plug.Conn{params: %{"id" => id}}, _opts) do
     case Repo.get(Annotation, id) do
       nil ->

  alias Core.Annotation

  plug Guardian.Plug.EnsureAuthenticated, %{handler: Core.Auth} when action in [:create, :update, :delete]
  plug Core.BodyParams, name: "annotation"
  plug :find when action in [:update, :delete, :show]

  def index(conn, _params) do
    annotations = Repo.all(Annotation)


    case Repo.update(changeset) do
      {:ok, annotation} ->
        annotation = Repo.preload(annotation, :annotation_tags)
        conn
        |> render("show.json", annotation: annotation)
      {:error, changeset} ->
        conn
        |> put_status(:unprocessable_entity)
