Object Based Authorization

Not sure about your specific issue. However there is a lot of good info about many to many relationships on Josh Susser's blog, http://blog.hasmanythrough.com/

-Jamal