Just released a blog post on implementing access control where I talk about various access control methods and building an actual HRBAC implementation
https://blog.nodeswat.com/implement-access-control-in-node-js-8567e7b484d1#.p2c8xb726
Feedback and comments welcome