All requests should be changed to define an action. The lib/auth.js file will map actions to roles, and config/index.js will map roles to users and groups.

Some day, a future project will take those mappings out of code, place them in data, and create an Admin portal for managing them.