zammad/app/policies/controllers/user_devices_controller_policy.rb

class Controllers::UserDevicesControllerPolicy < Controllers::ApplicationControllerPolicy
  default_permit!('user_preferences.device')
end