Pundit error: not allowed to index? this Class

I just started using administrate and encountered a problem when integrating with Pundit.

When I include Administrate::Punditize in the Admin::ApplicationController, I get a Pundit::NotAuthorizedError at my /admin route, with error: not allowed to index? this Class.

The action I'm rooting to is:

namespace :admin do
  resources :venues
  resources :users
  
  root to: "venues#index"
end

The Venues controller has:

  def index
    @venues = policy_scope(Venue)
  end

And the policy has:

class VenuePolicy < ApplicationPolicy
  class Scope < Scope
    def resolve
      scope.visible_to(user)
    end
  end

visible_to is an included module scope:

class_methods do
  def visible_to(user)
    user&.admin? ? all : published
  end
end

The policy works outside of administrate, so I'm not sure what I'm doing wrong here. Any ideas?

Start by reproducing the Pundit::NotAuthorizedError at /admin with Administrate::Punditize included in Admin::ApplicationController. Trace the admin root through VenuesController#index, policy_scope(Venue), and VenuePolicy::Scope#resolve, comparing it with the working behavior outside Administrate. Done means the integration's authorization behavior is understood and the reported /admin error has a confirmed resolution.