grails - REST API Design for systems with multiple companies or organizations -

most of examples see implement rest url patterns http://www.app.com/books/1 access book id 1 or http://www.app.com/books access books.

that's great, commonly work on applications support multiple companies. example, company abc has 2 users , company def has 2 users. user company abc creates book id 100. when restful call comes in user @ company def:

http://www.app.com/books/100

there need access exception, or

http://www.app.com/books

would list books belonging def (not new book id 100). many entities, book, company id part of table, other entities may not case. example, if there rest operation 1 chapter in book, http://www.app.com/chapter/333 chapter table have foreign key reference book not company.

what best practices managing access resource? if def tried access chapter abc have construct query join chapter book verify company id valid.

i'm using grails 3.x of logic abstracted , thinks happen "automagically". url comes in specific book id returned automatically , request list returns every book in database. seems proceed have override of automatic functionality , implement own security, perhaps in service layer company id required parameter every operation. sound reasonable?

is there established best practice sort of thing?

don't know if fits needs it's interesting know there acl plugin written burt beckwith :

spring security acl plugin