I am trying to build a permission system like bitbucket where a user(owner) has a company and company has products. There are groups at the company level which has access to all products and there is a product level access , by which a user can access the content of that particular product but not any other products of that company. I am using mongoose, expressjs and nodejs . Please suggest some solution for the same.