I would normally test this by testing the redirect (assuming you are
redirecting users that do not have permission)
If someone does not have permission to view a page, I normally
redirect to another page and show a flash notice
so in the test I would say
get :show, :id => @first_id, :user => @user_id, :division =>
assert_redirected_to notice_path # => specify your path here
As a tip - when naming tests, it's good practice to use the term
"should" or "should not"
This helps you clearly define the behavior you are testing for.