title: Are there any best practices for exposing resource permissions/ACL to a front end via a RESTful API?
body: <p>The question pretty much covers it. Given a RESTful API where we have multiple resource types and various user permissions around who can CRUD them, are there any established best practices for exposing those permissions to the front end so that the permissions don't have to be stored in two places?</p>
  
  <p>I have a pure JS application and I need to know when to, for example, display edit and delete links for a given resource. I would like a standard way to make these decisions based directly on the ACLs stored on the backend. I considered maybe bringing back an ACL portion in the REST envelope for all GET responses, but I was hoping maybe someone knew of an established best practice.</p>
  
  <p>For what it's worth, I'm also using Symfony2 and its security component.</p>