JCR 2.0 mandates only the resource based access control which is unfortunately insufficient in many real life scenarios. ModeShape already provides limited custom role based access control provider. It would be great to open this feature and API so that user of ModeShape can implement and use own custom access provider. Together with this it would be also great if the user can configure custom Login module to be used by ModeShape to authenticate user of the repository.