When I started using action_policy, I thought that "1 policy per controller" was the best way to organize my policies, eg:

• PostsController => PostPolicy
• Admin::PostsController => Admin::PostPolicy
• PostReportsController => API::PostPolicy
• Admin::FeaturedPostsController => Admin::FeaturedPostPolicy

It is working for my projects, I'm working on other projects that use "1 policy per model/resource" and reuse the policy on multiple controllers, eg.:

class PostPolicy < ApplicationPolicy
  def index? = ...
  
  def create? = ...
  
  def export_report? = ...
  
  def feature? = ...
end

# On PostReportsController 
def create
  authorize :export_report?, ..., with: PostPolicy
end

# On FeaturedPostsController
def create
    authorize :feature?, ..., with: PostPolicy
end

I don't have any objections with the second approach, but I have the feeling it will become harder to maintain, while I know the first approach can be easier to have duplicated/outdated permission code without a proper.

How do you organize your policies and has it worked well??