1. Extract an `admin_or_auditor?` method to clean up multiple uses of
  `user.admin? || user.auditor?`

2. Follow the four phase test rule.

3. Clean up the `project_policy_spec` by using %i for literal symbols

4. A number of other minor improvements.