ability.rb

class Ability
  include CanCan::Ability

  def initialize(user)
    can :create, Comment, :post => { :published => true }
  end
end

comments_controller.rb

class CommentsController < ApplicationController
  load_and_authorize_resource

  def create
    @comment.save
  end
end

new.html.erb

<%= form_for @post.comments.new do |f| %>
...
<% end %>

I always get CanCan::AccessDenied because @comment is not initialized when authorize!() runs.

Is there a way to check if Post.find(params[:post_id]) is published instead of trying to access the non-existent @comment.post?

How are you passing the post_id to the comment? If it's in the params[:comment][:post_id] it should all work. However if you have nested routes and need to build the comment through the post like Post.find(params[:post_id]).comments.build then you'll need to make it nested in CanCan.

load_and_authorize_resource :post
load_and_authorize_resource :comment, :through => :post

Then it will build the comment through the post.

Yes, I have nested routes. Thanks for clarifying!