app.coffee
-----
exports.getDataModel: (request) ->
	# admins or when security is bypassed
	if settings.security.bypass or settings.security.admins?[request?.remoteUser]
		request.user: {
			id: 'root'
			acl: () -> adminModel
		}
		return adminModel
	# vanilla user, have to wait for DB
	promise.when model.User.get(request?.remoteUser), (user) ->
		request.user: user or {}
		return publicModel unless user
		user.acl()

.....

model.coffee
-----
model: exports.DataModel: {
	User: Model Store({collection: 'User'}), {
		properties: {
			password: {type: 'string'},
.....
			access: {'default': {
				#Foo: {r: true, w: true}
				Foo: {r: true}
			}}
		}
		prototype: {
			acl: () ->
				r: {}
				return r unless this.active
				for k, v of this.access
					if v.w
						r[k]: Facet.Permissive model[k]
					else if v.r
						r[k]: Restrictive model[k]
				r
		}

.....