docs: function setRuleModule (roles, rule, rules, origRule) {
      // allow/deny is last element of rule
      var allow = rule.pop()
      // blanket rule for all modules
      if (rule.length === 0) {
          // create role access rule map
          if (!rules.allow) {
              rules.allow = {}
          }
          // set rule for each role
          _.each(roles, role => {
              rules.allow[role] = allow
          })
          // break
          return
      }
  
      // module name is first clause of rule
      var module = rule.shift()
      // create map of models
      if (!rules.module) {
          rules.module = {}
      }
      // create entry for module
      if (!rules.module[module]) {
          rules.module[module] = {}
      }
  
      // blanket rule for single module
      if (rule.length === 0) {
          // create role access rule map
          if (!rules.module[module].allow) {
              rules.module[module].allow = {}
          }
          // set rule for each role
          _.each(roles, role => {
              rules.module[module].allow[role] = allow
          })
      }
      // rule for method
      else if (rule.length === 1) {
          var method = rule.shift()
          // create map of methods
          if (!rules.module[module].method) {
              rules.module[module].method = {}
          }
          // create method entry
          if (!rules.module[module].method[method]) {
              rules.module[module].method[method] = {}
          }
          // create role access rule map
          if (!rules.module[module].method[method].allow) {
              rules.module[module].method[method].allow = {}
          }
          // set rule for each role
          _.each(roles, role => {
              rules.module[module].method[method].allow[role] = allow
          })
      }
      // invalid rule
      else {
          throw new Error('invalid rule '+origRule)
      }
  }