  def access?(query)
    return false if record.internal == true && !user.permissions?('ticket.agent')

    ticket = Ticket.lookup(id: record.ticket_id)
    Pundit.authorize(user, ticket, query)
  end
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.