In large apps, simple authentication with logged in and logged out checks is often not enough. Users may have different access levels, for example, admins and regular users, moderators and super admins. In addition to that, users may have different permissions on individual resources; for instance, a user can delete or edit their own blog post, but cannot do anything with someone else's post. Such complex permission and role-based systems can are usually called Role-Based Access Control (RBAC).
There are many open source implementations, but for our case we need a special one: it must be isomorphic because permissions checks will be performed both on the client and the server sides.
We will start ...
