title: How does an OAuth2 (Bearer) token translate to an ACL
body: <p>I have been looking into OAuth2 lately and I think I understand the authorization process. </p>
  
  <p>However, what I don't seem to understand is, once authorization has taken place and an <code>access_token</code> and a <code>refresh_token</code> have been established to make calls, how is the decision made based on the <code>access_token</code> if the request can or cannot access a specific resource?</p>
  
  <p>I.e. a token is send to the server to request a photo. How does the logic on the server determines, based on the given token, that access to that particular photo is allowed or denied?</p>