Hey, I went through https://github.com/cerebris/jsonapi-resources/issues/16 and found your gem, looks nice.
I have one question though, does the operations_processor approach take care of authorizing the included resources? Let me give you an example:

class PostResource < JSONAPI::Resource
  # read authorized for current_user
  has_many :comments 
end

class CommentResource < JSONAPI::Resource
  # read authorized for current_user
  has_one :user 
end

class UserResource < JSONAPI::Resource
  # read authorized ONLY when user == current_user
  has_many :comments 
end

If you try to get a post with the following request: GET /posts/1?include=comments.user we need to ensure that all comments and users relationships are authorized as well and not only the Post 1.

I think that @barelyknown's approach take care of that by overwriting the JSONAPI::Resource#records_for method but I'm not sure with your approach.

What do you think? Thanks for your gem!