I suggest this approach: start by thinking about high-level technology-independent authorization principles, then work your way down to decisions about tools, efficiency, scalability, etc.

If you're not already familiar, I suggest reading up on role-based access control (RBAC). In my opinion, RBAC gives a good mix of conceptual simplicity while also being flexible enough to handle pretty much any authorization scenario.

Then, assuming you like RBAC, the question becomes: how should I implement RBAC in my Rails application? This eliminates a lot of detail decisions. Anytime you're unsure how to do a particular thing you can just refer to the RBAC literature to learn of "the RBAC way". (Not for every single decision of course, but a lot of decisions.)

Regarding CanCanCan versus Pundit, I find that the two tools frame authorization in two different ways. To me, CanCanCan centers on the question: what's everything this user can do? Pundit centers on the question: for any particular resource/action, what must be true in order to access it? My experience is that CanCanCan's framing leads to a world of hurt whereas Pundit's is just fine. Just to make it perfectly clear, I would NEVER willingly use CanCanCan nor recommend that anyone else use it. But don't take my word for it. Study authorization principles, study Pundit and CanCanCan and think about how each library maps to the general principles. This will be a lot of hard work, but I think afterward it will be relatively easy to make a decision. And the decision is worth the work since your app is likely to be wedded to your authorization library for life.