Contextual authorization for "collection" operations

So you have two options here.

Use the arguments to look up related info

The first one is to use the input arguments to determine the related thing, and then operate on that information.

For example:

defmodule YourApp.Checks.MatchesDrinkingAge do
  use Ash.Policy.SimpleCheck

  def match?(actor, %{source: %Ash.Changeset{} = changeset}, _opts) do
     country_id = Ash.Changeset.get_argument(changeset, :country_id)
     # lookup the country id, and return `true` or `false` depending
  end
end

Put the action on the thing that controls the rules

This is probably not what you want in this case, but can be useful to simplify

# on Country
create :add_beer do
  # create the beer in a hook
  ...
end

It’s actually a little bit inconvenient to authorize data creation when compared with our other check types, and I would really like to build up some more tools for this kind of thing.
But, although slightly more verbose than we’d prefer, you can ultimately do “anything you want” in simple checks, and those should allow for any authorization logic you need in this case.