In my application I do this using tables in the database. The database has a roles table, a permissions table, a roles_permissions table and a roles_users tabl

In my application I do this using tables in the database. The database has a roles table, a permissions table, a roles_permissions table and a roles_users table. When a user it looked up, a JOIN is done to pull in all the permissions assigned to all the roles, then there's a configuration that specifies with permission is required to access each API call. This allows us the flexibility of adding additional roles and permission combinations without making any code changes.