I don't consider this a bug. For example, consider an action item (which likely contains a link) can still be displayed even if the user doesn't have access. Although it can be supplied a hook (if block) to control whether it's rendered or not. The policy should prevent not the display of the link but an unauthorized user from loading the page. If you click the link as an unauthorized user, does the page still load?

I thought the default behavior was either to hide the link completely like it's the case with "Edit"/"Destroy" buttons etc.

...or, in case ofauto_link method: it shows the link when user is authorized to show/edit the resource, or it shows plain text.
I think this would make most sense for breadcrumbs.

In my project, users can manage sub-resources, to which they get from parent#index page. They don't have access to parent#show nor parent#edit.

Does that make sense?

PS the page doesn't load. It fails authorization.

it shows plain text.

I like this idea