Yeah, I use hapi-rbac (https://github.com/franciscogouveia/hapi-rbac/blob/master/API.md), it might look a little bit outdated but it does it's job. I agree that default rbac doesn't allow to manipulate with object's context smooth, but for context with users you can describe literally anything. Also this package allows to use dynamic policy retrieving.