policy for BelongsToMany field

BelongsToMany is a many-to-many relationship. This basically means it's only connected by a pivot table, so each model is its own identity. Because of that, you need to enable it on the model itself.

So in your case, if you want to be able to see the model from you need to set the policy for that model

class SomethingPolicy
{
    public function viewAny()
    {
        return true;
    }

    public function view()
    {
        return true;
    }
}

Because the view of Something is true, you can always click on it from your other many-to-many model.

idk if I can reopen instead of saying it is solved but it didn't work. I tried multiple methods including attach{model} didn't work. I still can attach.

    public function attachAnyRole(User $user, Role $role)
    {
        return false;
    }

        MorphToMany::make('Roles', 'roles', \Vyuldashev\NovaPermission\Role::class),

Have you tried using attachRole?

Documentation: https://nova.laravel.com/docs/3.0/resources/authorization.html#authorizing-attaching-detaching

Note that it's based on the model name, not the relationship name. I was stuck on that for quite some time. So it's: attach{Model} (like the docs say) for a single model. And attachAny{Model} for attaching any.

Also note... I just read my own reply from 4 months ago, and again I was frustrated like crazy. The Str::singular() method which is used under the hood does not ALWAYS correctly use the right singular form of your model name. My model name ends with "Analysis" of which it thinks the singular form is "Analysi" which would make your policy name "attachAnyAnalysi".