docs: function callback(req, res, resolve, reject, error, result, permissions,
  	action) {
  	if (error) {
  		reqlog.error('internal server error', error);
  		if (exports.handleErrors) {
  			responseBuilder.error(req, res, 'INTERNAL_SERVER_ERROR');
  		} else {
  			reject(error);
  		}
  	} else {
  		// filter the result attributes to send only those that this userType can see
  		// check if the result is an array, to iterate it
  		if (Array.isArray(result)) {
  			for (var i = 0, length = result.length; i < length; i++) {
  				result[i] = filterAttributes(result[i], permissions);
  			}
  		} else {
  			result = filterAttributes(result, permissions);
  		}
  		reqlog.info(action + '.success', result);
  		resolve(result);
  	}
  
  	/**
  	 * Delete the attributes that the activeUser cant see
  	 * @method filterAttributes
  	 * @param  {object}         object      The result object
  	 * @param  {object}         permissions The permissions object
  	 * @return {object}                     The filtered object
  	 */
  	function filterAttributes(object, permissions) {
  		if (object) {
  			var userType = req.activeUser && req.activeUser.type || 'null';
  			for (var attribute in object._doc) {
  				if (object._doc.hasOwnProperty(attribute)) {
  					// dont return this attribute when:
  					if (!permissions[attribute] || // if this attribute is not defined in permissions
  						permissions[attribute][0] !== 'null' && // this attribute is not set as public
  						permissions[attribute].indexOf(userType) === -1 && // this attribute is not available to this userType
  						userType !== 'admin' // the user is not admin
  					) {
  						delete object._doc[attribute];
  					}
  				}
  			}
  		}
  
  		return object;
  	}
  }