We use Keto (permissions) and Kratos (Identities) for this under the hood with some custom code in between to make it all work nicely with each other.
I don't think we have any of that publicly available at the moment unfortunately, but @steep-lamp-91158 might be able to share some more details.