We are developing a MEAN stack application that includes discretionary access control for business/domain objects, much like a file or content management system does. Users must be able to give other users access (read/edit) to a hierarchy of workspaces, folders, and items. Permissions must be inherited down the hierarchy until changed. The software we need must be able to secure tens of thousands of domain objects as well. I've run across Keycloak and Node-ACL so far.
Can anyone suggest a product or framework for managing discretionary access control / ACLs for domain objects?