My findings:

1. Use authorized? instead of can?, which uses the proper ability class.
2. Use accessible_by instead of batch_action_collection .

Here's a working example

batch_action :publish, confirm: "Are you sure?", if: proc { authorized? :publish, Payments::Product } do |ids, *args|
  Payments::Product.transaction do
    Payments::Product.accessible_by(active_admin_authorization.cancan_ability, :publish).where(id: ids).
      find_each(batch_size: 10) { |product| product.update!(published: true) }
  end

  redirect_back fallback_location: collection_path(params.permit(q: {})), alert: "Published successdfully!"
end

The docs are misleading https://activeadmin.info/9-batch-actions.html#creating-your-own

@heaven thank you. Fixing this as a bug and/or a documentation update will be dependent on your contribution. We are open to a PR to resolve it.

Using authorized? is the expected approach but I can see why can? was used since that's referenced in the documentation. Feel free to submit an update for that to use authorized? instead. There are other instances that will need to be updated or removed.

I'm not familiar with CanCanCan, sorry. I use Pundit. I don't see any issue doing that without the helper since that is valid. I've done both. I don't think the documentation is misleading in that it's meant to handle every possibility either. I would suggest adding an example to use a manual query as another option in the docs. The other would be for you to review what the issue is with batch_action_collection and submit a bug fix or feature update.