diff --git a/app/Http/Controllers/RecipeController.php b/app/Http/Controllers/RecipeController.php
index e611c8c..e5bf4a8 100644
--- a/app/Http/Controllers/RecipeController.php
+++ b/app/Http/Controllers/RecipeController.php
@@ -5,6 +5,7 @@ namespace App\Http\Controllers;
 use App\Models\Recipe;
 use Illuminate\Contracts\View\Factory as ViewFactory;
 use Illuminate\Contracts\View\View;
+use Illuminate\Support\Facades\Gate;
 
 class RecipeController extends Controller
 {
@@ -37,6 +38,14 @@ class RecipeController extends Controller
 
     public function edit(Recipe $recipe): View|ViewFactory
     {
+        if (! $this->canEditRecipe($recipe)) {
+            abort(403, 'Unauthorized action.');
+        }
         return view('recipe/edit_form', ['recipe' => $recipe]);
     }
+
+    private function canEditRecipe(Recipe $recipe): bool
+    {
+        return Gate::allows('edit', $recipe);
+    }
 }
diff --git a/app/Livewire/Recipe/Edit.php b/app/Livewire/Recipe/Edit.php
index fd7545d..ef4acd8 100644
--- a/app/Livewire/Recipe/Edit.php
+++ b/app/Livewire/Recipe/Edit.php
@@ -189,7 +189,8 @@ class Edit extends Component
                 if (is_string($step['image'])) {
                     $data['image'] = $step['image'];
                 } else {
-                    $data['image'] = $step['image']->store('steps', 'public');
+                    // $data['image'] = $step['image']->store('steps', 'public');
+                    $data['image'] = $step['image']->store('steps');
                 }
                 $data['description'] = $step['description'];
 
diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php
index 060f28c..2299d64 100644
--- a/app/Providers/AuthServiceProvider.php
+++ b/app/Providers/AuthServiceProvider.php
@@ -3,7 +3,9 @@
 namespace App\Providers;
 
 use App\Models\Plan;
+use App\Models\Recipe;
 use App\Policies\PlanPolicy;
+use App\Policies\RecipePolicy;
 use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
 
 class AuthServiceProvider extends ServiceProvider
@@ -15,6 +17,7 @@ class AuthServiceProvider extends ServiceProvider
      */
     protected $policies = [
         Plan::class => PlanPolicy::class,
+        Recipe::class => RecipePolicy::class,
         // 'App\Models\Model' => 'App\Policies\ModelPolicy',
     ];
 
diff --git a/tests/Feature/Recipe/EditTest.php b/tests/Feature/Recipe/EditTest.php
index d68d2f2..fd0f746 100644
--- a/tests/Feature/Recipe/EditTest.php
+++ b/tests/Feature/Recipe/EditTest.php
@@ -37,13 +37,24 @@ final class EditTest extends TestCase
         $this->recipe = Recipe::inRandomOrder()->first();
     }
 
-    public function test_edit_page_recipe_success(): void
+    public function test_show_form_edit_recipe_success_for_author(): void
+    {
+        $user = $this->user;
+        $recipe = Recipe::factory()->create();
+        $user->author_of_recipe()->attach($recipe->id);
+
+        $response = $this
+            ->actingAs($user)
+            ->get(route('recipe.edit', $recipe));
+        $response->assertSuccessful();
+    }
+
+    public function test_show_form_edit_recipe_forbidden_for_not_author(): void
     {
         $response = $this
             ->actingAs($this->user)
-            ->get(route('recipe.edit', $this->recipe, false));
-
-        $response->assertSuccessful();
+            ->get(route('recipe.edit', $this->recipe));
+        $response->assertForbidden();
     }
 
     public function testUpdateRecipePublishSuccess(): void