I think you need a guardian method to check if a user is allowed to perform a given action. for e.g. can_upgrade_server?
Also, once you do that, you can use guardian.ensure_can_upgrade_server! method which checks the condition and raises an exception which I think is exactly what you want.