In my application I do this using tables in the database.  The database has a roles table, a permissions table, a roles_permissions table and a roles_users table.  When a user it looked up, a JOIN is done to pull in all the permissions assigned to all the roles, then there&#x27;s a configuration that specifies with permission is required to access each API call.<p>This allows us the flexibility of adding additional roles and permission combinations without making any code changes.