Pundit Policy on Join Models

project_resource_policy,rb

class Project < AR::B
  has_many :project_reources
  has_many :resources, through: :project_resources
end

class Resource < AR::B 
  has_many :project_resources
  has_many :projects, through: :project_resources
end

class ProjectResource < AR::B
  belongs_to :project
  belongs_to :resource
end

class ResourcesController < ApplicationController

  def show
    @project = Project.find(params[:project_id])
    project_resource = project.project_resources.find_by(resource_id: params[:id])
    @resource = project_resource.resource

    authorize project_resource, :show?
  end

end

class ProjectResourcePolicy < ApplicationPolicy
  alias_method :project_resource, :record

  def show?
    # decide if a user is authorized to view a resource in the context of a project
    project, resource = project_resource.project, project_resource.resource

    # Your authorization logic, 
    # you can now access user, project and resource
    user.owner_of?(project) && resource.non_lethal?
  end

end