docs: function applyRules(rules, model, user) {
      const rulePromises = _.map(rules, (rule) => rule.applyTo(model, user));
      return Promise.all(rulePromises)
  
          //TODO validate rule results to handle optional vs. required auth...
          .catch(function catchAuthError(error) {
              return Promise.reject(error);
          });
  }