title: Control access to app resources with Active Directory
body: <p>Let's say we have a web app that lets the user create &quot;widgets&quot;. We have a new client that would like to control access to each widget with their organization's Active Directory, such that some of their users can view certain widgets and other users can edit other widgets.</p>
  <p>What's the proper way to implement this? Should every widget have its own read group and modify group, and we let the client control the membership to these groups? Is there a better way?</p>