diff --git a/app/controllers/doodads_controller.rb b/app/controllers/doodads_controller.rb
index f8a27c37..53f8ff66 100644
--- a/app/controllers/doodads_controller.rb
+++ b/app/controllers/doodads_controller.rb
@@ -3,7 +3,7 @@ class DoodadsController < ApplicationController
 
   # GET /doodads or /doodads.json
   def index
-    @doodads = authorize policy_scope(Doodad)
+    authorize @doodads = policy_scope(Doodad)
   end
 
   # GET /doodads/1 or /doodads/1.json
diff --git a/app/controllers/visitors_controller.rb b/app/controllers/visitors_controller.rb
index 30fa7d47..16b78e44 100644
--- a/app/controllers/visitors_controller.rb
+++ b/app/controllers/visitors_controller.rb
@@ -2,7 +2,7 @@ class VisitorsController < ApplicationController
   before_action :skip_authorization
 
   def index
-    @doodads = authorize Doodad.all
+    @doodads = authorize policy_scope(Doodad)
     @canisters = authorize Canister.all
   end
 end
diff --git a/app/policies/doodad_policy.rb b/app/policies/doodad_policy.rb
index 654eabab..96c104da 100644
--- a/app/policies/doodad_policy.rb
+++ b/app/policies/doodad_policy.rb
@@ -42,11 +42,11 @@ class DoodadPolicy
   end
 
   def edit?
-    @user.admin? || @user == @doodad.user || @doodad.user.nil?
+   @user.admin? || @user == @doodad.user || (@doodad.is_public? && @doodad.user.nil?)
   end
 
   def update?
-    @user.admin? || @user == @doodad.user || @doodad.user.nil?
+    @user.admin? || @user == @doodad.user || (@doodad.is_public? && @doodad.user.nil?)
   end
 
   def destroy?
diff --git a/app/views/doodads/_doodad.html.haml b/app/views/doodads/_doodad.html.haml
index 3ffd8e4c..64d6e352 100644
--- a/app/views/doodads/_doodad.html.haml
+++ b/app/views/doodads/_doodad.html.haml
@@ -1,3 +1,5 @@
-.doodad
-  = doodad.body.html_safe
-  = link_to 'Edit', edit_doodad_path(doodad)
+- if policy(doodad).show?
+  .doodad
+    = doodad.body.html_safe
+    - if policy(doodad).edit?
+      = link_to 'Edit', edit_doodad_path(doodad)