authorize via relate? with a reference to the related class.

patch_for_jsonapi_authorization_relations.rb

module JSONAPI
  module Authorization
    class DefaultPunditAuthorizer
      def create_resource(source_class, related_records)
        ::Pundit.authorize(user, source_class, 'create?')

        related_records.each do |record|
          user.define_singleton_method(:source_class) do
            source_class
          end
          ::Pundit.authorize(user, record, 'relate?')
        end
      end
    end
  end
end