var ACL = require('koa-acl');
var Acl = require('acl');
app.use(
    ACL({
        //user getter
        user: function(ctx) {
            return ctx.state.user._id;
        },
        //backend getter
        backend: new Acl.memoryBackend()
    })
);

var ACL = require('koa-acl');
route.delete(
    '/api/users/:user',
    ACL.middleware(2),
    function* (next) {
        //do something...
    }
);

options.user    {Function} user ID getter.
options.backend {Object|Function} backend getter.

numPathComponents   {Number}    number of components in the url to be considered part of the resource name (defaults to number of components in the full url).
userId {String|Function}   user ID (defaults to options.user).
actions {String|Array}    lowercase.

npm test