title: ACL granularity
body: <p>I'm trying to implement ACL for my nodejs App. Say i have the following endpoints:</p>
  
  <pre><code>/api/user
  /api/picture 
  </code></pre>
  
  <p>Pictures belong to users.</p>
  
  <p>ACL is able to allow/deny access based on userId to an endpoint. If a request comes to /api/user it is easy for the ACL to know if a certain userId can access it's own data or not: if i'm userId=23 and i do a GET on /api/user/23 there is a direct relation between the resource being requested and the data given to use for checking.</p>
  
  <p>Now, if a request comes to /api/picture with a pictureId, the ACL is not aware of the relation between users and pictures, say /api/picture/60; the ACL does not know if pictureId=60 belongs to userId=23 (used in the example above).</p>
  
  <p>Do you know if there is any ACL solution for nodejs which support this kind of access control? How granular is ACL expected to be?</p>