At matestack, we have had good experiences using matestack with Pundit. CanCanCan, another very popular authorization library in Rails, is also supported, as shown below!
Both Pundit and CanCanCan use pure Ruby and focus on the model and controller layer, so they are compatible to matestack's UI library.
Example 1: Pundit
Here we see how Pundit defines policies and we can check for them in the controller action, just before matestack's responder_for!