Did you represent user -> role mappings in your postgres db, or did you model ACLs for every object?