diff --git a/app/graphql/mutations/companies/update_company.rb b/app/graphql/mutations/companies/update_company.rb
index 3a22ed1..c48a8b0 100644
--- a/app/graphql/mutations/companies/update_company.rb
+++ b/app/graphql/mutations/companies/update_company.rb
@@ -13,7 +13,7 @@ def resolve(id:, attributes:)
         # find company
         company = ::Companies::Company.accessible_by(current_ability).find_by(id: id)
         if company.nil?
-          raise I18n.t('errors.messages.resource_not_found', resource: ::Companies::Company.model_name.human)
+          raise ActiveRecord::RecordNotFound, I18n.t('errors.messages.resource_not_found', resource: ::Companies::Company.model_name.human)
         end
 
         company.attributes = attributes.to_h
diff --git a/app/graphql/types/mutation_type.rb b/app/graphql/types/mutation_type.rb
index 93d5987..f605a7c 100644
--- a/app/graphql/types/mutation_type.rb
+++ b/app/graphql/types/mutation_type.rb
@@ -7,6 +7,11 @@ class MutationType < Types::BaseObject
     implements ::Types::GraphqlAuth
 
     # Mutations
+    field :update_user, mutation: Mutations::UpdateUser
+    field :update_user_role, mutation: Mutations::UpdateUserRole
+    field :delete_user, mutation: Mutations::DeleteUser
+
+    # Company
     field :update_company, mutation: Mutations::Companies::UpdateCompany
   end
 end
diff --git a/config/initializers/cors.rb b/config/initializers/cors.rb
index 547f64e..a01c131 100644
--- a/config/initializers/cors.rb
+++ b/config/initializers/cors.rb
@@ -13,8 +13,8 @@
 
     # origins '*'
     resource '*',
-      :headers => :any,
-      :expose  => ['Authorization'],
-      :methods => [:get, :post, :options, :delete, :put]
+             headers: :any,
+             expose: ['Authorization'],
+             methods: %i[get post options delete put]
   end
 end
diff --git a/config/initializers/graphql_errors.rb b/config/initializers/graphql_errors.rb
index 2a31069..4b2120b 100644
--- a/config/initializers/graphql_errors.rb
+++ b/config/initializers/graphql_errors.rb
@@ -5,6 +5,10 @@
     nil
   end
 
+  rescue_from CanCan::AccessDenied do |exception|
+    GraphQL::ExecutionError.new(exception.message)
+  end
+
   rescue_from ActiveRecord::RecordInvalid do |exception|
     GraphQL::ExecutionError.new(exception.record.errors.full_messages.join("\n"))
   end