Protector is about controlling models.
How can I deal with controllers #new & #edit actions?
They do not interact with database, but render views that shouldn't be rendered. I should get an error this way.
Protector does not work on controller level. However you can use meta methods like can? to evaluate your permission block and get the result even if you don't use models directly.