diff --git a/app/controllers/submissions_controller.rb b/app/controllers/submissions_controller.rb
index fd598309..04bc5e94 100644
--- a/app/controllers/submissions_controller.rb
+++ b/app/controllers/submissions_controller.rb
@@ -1,9 +1,7 @@
 # frozen_string_literal: true
 
 class SubmissionsController < ApplicationController
-  before_action :load_template, only: %i[new create]
-  authorize_resource :template, only: %i[new create]
-
+  load_and_authorize_resource :template, only: %i[new create]
   load_and_authorize_resource :submission, only: %i[show destroy]
 
   prepend_before_action :maybe_redirect_com, only: %i[show]
@@ -113,8 +111,4 @@ class SubmissionsController < ApplicationController
   def submissions_params
     params.permit(submission: { submitters: [:uuid, :email, :phone, :name, { values: {} }] })
   end
-
-  def load_template
-    @template = Template.accessible_by(current_ability).find(params[:template_id])
-  end
 end
diff --git a/lib/mcp/tools/load_template.rb b/lib/mcp/tools/load_template.rb
index 7cfcc3ff..ee52af37 100644
--- a/lib/mcp/tools/load_template.rb
+++ b/lib/mcp/tools/load_template.rb
@@ -30,9 +30,9 @@ module Mcp
       def call(arguments, _current_user, current_ability)
         template = Template.accessible_by(current_ability).find_by(id: arguments['template_id'])
 
-        return { content: [{ type: 'text', text: 'Template not found' }], isError: true } unless template
-
-        current_ability.authorize!(:read, template)
+        if !template || !current_ability.can?(:read, template)
+          return { content: [{ type: 'text', text: 'Template not found' }], isError: true }
+        end
 
         submitters_index = template.submitters.index_by { |s| s['uuid'] }
 
diff --git a/lib/mcp/tools/send_documents.rb b/lib/mcp/tools/send_documents.rb
index 011224be..87dd8e0e 100644
--- a/lib/mcp/tools/send_documents.rb
+++ b/lib/mcp/tools/send_documents.rb
@@ -73,7 +73,9 @@ module Mcp
       def call(arguments, current_user, current_ability)
         template = Template.accessible_by(current_ability).find_by(id: arguments['template_id'])
 
-        return { content: [{ type: 'text', text: 'Template not found' }], isError: true } unless template
+        if !template || !current_ability.can?(:read, template)
+          return { content: [{ type: 'text', text: 'Template not found' }], isError: true }
+        end
 
         if template.archived_at?
           return { content: [{ type: 'text', text: 'Template has been archived' }], isError: true }