policies.js

// config/policies.js
module.exports = {
  '*': false,
  
  user: {
    create: true,
    find: true,
    update: true,
    destroy: true
  },
  
  role: {
    create: true,
    find: true,
    update: true,
    destroy: true
  }
};

// api/models/User.js
module.exports = {
  attributes: {
    name: 'string',
    roles: {
      collection: 'role',
      via: 'users'
    }
  }
};

// api/models/Role.js
module.exports = {
  attributes: {
    users: {
      collection: 'user',
      via: 'roles'
    },

    name: {
      type: 'string',
      required: true
    }
  }
};