What is the best way to set an authorization for the primary `:read` action when creating a linked Resource?

You can pass an authorize?: false option to manage_relationship if you want the parent action’s authorization rules to be the arbiter in this context. That might have helped with your original design.