I'm hoping to return only the Incidents where the user has permission "inc" for ALL categories of that Incident.

gistfile1.rb

Incident.joins(categories: [{category_marks: [{ user_group: :users }] }])
        .where("users.id = ? AND category_marks.inc = ?", user.id, true)
        .group('incidents.id')

schema.rb

  create_table "categories", :force => true do |t|
    t.string   "name"
    t.string   "color"
    t.datetime "created_at"
    t.datetime "updated_at"
    t.boolean  "medical",    :default => false
    t.integer  "parent_id"
    t.integer  "lft"
    t.integer  "rgt"
    t.boolean  "active",     :default => true
  end

  create_table "categories_incidents", :id => false, :force => true do |t|
    t.integer "category_id"
    t.integer "incident_id"
  end

  create_table "category_marks", :force => true do |t|
    t.integer "user_group_id"
    t.integer "category_id"
    t.boolean "stu",           :default => false
    t.boolean "inc",           :default => false
    t.boolean "add",           :default => false
  end
  
  create_table "incidents", :force => true do |t|
    t.integer  "student_id"
    t.integer  "user_id"
    t.string   "content"
    t.datetime "created_at"
    t.datetime "updated_at"
    t.integer  "parent_id"
    t.text     "text_encrypted",  :limit => 2147483647
    t.datetime "user_created_at"
  end

  create_table "user_groups", :force => true do |t|
    t.string   "name"
    t.datetime "created_at"
    t.datetime "updated_at"
  end

  create_table "users", :force => true do |t|
    t.string   "title"
    t.string   "firstname"
    t.string   "surname"
    t.string   "email"
    t.string   "password"
    t.string   "yubikey_code"
    t.string   "job_title"
    t.string   "active",               :default => "1"
    t.boolean  "hidden",               :default => false
    t.integer  "user_group_id"
    t.date     "last_password_change"
    t.boolean  "enabled",              :default => true
    t.string   "mis_id"
    t.string   "legal_firstname"
    t.string   "legal_surname"
    t.string   "initials"
    t.string   "guid"
    t.datetime "created_at"
    t.datetime "updated_at"
  end