ファイル名とパスの対応表: `app/Policies/UserBookPolicy.php` => `UserBookPolicy.php`, `app/Exceptions/Handler.php` => `Handler.php`, `app/Providers/AuthServiceProvider.php` => `AuthServiceProvider.php`, `app/Http/Controllers/UserBookController.php` => `UserBookController.php`

AuthServiceProvider.php

<?php

namespace App\Providers;

use Illuminate\Support\Facades\Gate;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;

class AuthServiceProvider extends ServiceProvider
{
    /**
     * The policy mappings for the application.
     *
     * @var array
     */
    protected $policies = [
        'App\Model' => 'App\Policies\ModelPolicy',
        'App\UserBook' => 'App\Policies\UserBookPolicy'
    ];

    // ......
}

Handler.php

<?php

namespace App\Exceptions;

use Exception;
use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
use Illuminate\Auth\Access\AuthorizationException;
use Illuminate\Database\Eloquent\ModelNotFoundException;

class Handler extends ExceptionHandler
{
    // ......

    /**
     * Render an exception into an HTTP response.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Exception  $exception
     * @return \Illuminate\Http\Response
     */
    public function render($request, Exception $exception)
    {
        if ($exception instanceof AuthorizationException) {
            return response()->json([
                'errors' => [$exception->getMessage()]
            ], 403);
        }

        return parent::render($request, $exception);
    }
}

UserBookController.php

<?php

namespace App\Http\Controllers;

use App\UserBook;
use App\User;

class UserBookController extends Controller
{
    public function __construct(){
      $this->middleware('can:update,userBook')->only('update');
    }


    // ......


    // UserBookモデルをDIしよう
    public function update(Request $request, User $user, UserBook $userBook)
    {
        // ......
    }
}

UserBookPolicy.php

<?php

namespace App\Policies;

use App\User;
use App\UserBook;
use Illuminate\Auth\Access\HandlesAuthorization;

class UserBookPolicy
{
    use HandlesAuthorization;    
  
    /**
     * Determine whether the user can update the user book.
     *
     * @param  \App\User  $user
     * @param  \App\UserBook  $userBook
     * @return mixed
     */
    public function update(User $user, UserBook $userBook)
    {
        if ($user->id == $userBook->user_id) {
            return true;
        }
        throw new AuthorizationException('自分以外の本棚を編集することはできません。');
    }
}