accesscontrol

AccessControl answers one question in your Node backend: can this role do this to that resource? You declare roles and grants in a chainable API, and it handles RBAC and ABAC together: role inheritance, deny overrides, own-versus-any ownership checks, and attribute filtering that strips fields a role shouldn't see. MIT and free.

There is nothing to operate. It's an in-process npm library with no service, no database, no policy server. The 3.0 rewrite turned it into a fuller policy engine, with condition expressions, mandatory gates, and async conditions, so it now covers ground that used to require an external service.

Use it when hand-rolled role checks start spreading through your codebase and you're not ready for a dedicated policy service. CASL and node-casbin are the OSS competition; Oso, Cerbos, and Permit.io are the paid services this keeps you from needing early. Free at any team size.

The catch: it's one maintainer's project. Development is active, but bus factor is the standing risk, and the 3.x policy engine is a big fresh rewrite, so expect some API churn while it settles.