How to handle authenticated user access to resources in document oriented system?
I'm developing a document oriented application and need to manage user access to the documents. I have a module that handles user authentication, and another module that handles document CRUD operations on the data store. Once a user is authenticated I need to enforce what operations the user can and cannot perform to documents based upon the user's permissions. The best option I could think of to integrate these two pieces together would be to create another module that duplicates the data API but that also takes the authenticated user as a parameter. The module would delegate the authorization check to the auth module and delegate the document operation to the data access module. Something like:

     -module(auth_data_access).

     % User is authenticated (logged into the system)
     % save_doc validates if user is allowed to save the given document and if so
     % saves it returning ok, else returns {error, permission_denied}
     save_doc(Doc, User) ->
        case auth:save_allowed(Doc, User) of
           ok ->
              ok = data_access:save_doc(Doc);
           denied ->
              {error, permission_denied}
         end
      end. 

Is there a better way I can handle this? 

NB - my implementation language is Erlang and the backing store is Couchdb but I think that the question isn't so much language specific.
How to handle authenticated user access to resources in document oriented system?
===

I'm developing a document oriented application and need to manage user access to the documents. I have a module that handles user authentication, and another module that handles document CRUD operations on the data store. Once a user is authenticated I need to enforce what operations the user can and cannot perform to documents based upon the user's permissions. The best option I could think of to integrate these two pieces together would be to create another module that duplicates the data API but that also takes the authenticated user as a parameter. The module would delegate the authorization check to the auth module and delegate the document operation to the data access module. Something like:

     -module(auth_data_access).

     % User is authenticated (logged into the system)
     % save_doc validates if user is allowed to save the given document and if so
     % saves it returning ok, else returns {error, permission_denied}
     save_doc(Doc, User) ->
        case auth:save_allowed(Doc, User) of
           ok ->
              ok = data_access:save_doc(Doc);
           denied ->
              {error, permission_denied}
         end
      end. 

Is there a better way I can handle this? 

NB - my implementation language is Erlang and the backing store is Couchdb but I think that the question isn't so much language specific.