SSIA

Justin: "we basically used a middleware to call out to the rbac app to check the permissions of the user. We also have a 'fake' middleware service for local testing (where you can configure users that are given specific permissions)."

So you can steal their code for this task.