This should work great with #2126

UP

I wonder if this can be achieved by making all methods return false in the ApplicationPolicy?

I've been using some monkey-patching as a workaround, which has been working good so far. Just a little inconvenient having to manually add it for every association.

application_policy.rb

def self.has_association(association, with_full_permissions = false)
  ['create', 'attach', 'detach', 'destroy', 'edit'].each do |action|
    define_method(:"#{action}_#{association}?") { with_full_permissions }
  end
  define_method(:"show_#{association}?") { Pundit.policy!(user, record).show? }
  alias_method :"view_#{association}?", :show?
end

Kudos to @segiddins for sharing this in #1574

As for a more permanent solution, I'm really not sure how.