如何正确使用 authorize 验证权限

我现在需要在删除之前验证，这个帖子是不是对应的用户发布的,但是我设置以后一直返回403，不知道哪里出错了

contorller

public function historyDelete(User $user, Request $request, UserNumHistory $user_num_history)
    {
        if($request->ajax()) {

            $this->authorize('destroy', $user_num_history);
            .
            .
            .
        }
    }

Policy

public function destroy(User $user, UserNumHistory $user_num_history)
    {
        return $user_num_history->user_id === $user->id;
    }