I have some kind of data structure for my model for now, I m still figuring out along the way, but one of the concerns is that I need to serve the data from the mongo based on the user logged in.

One of the approaches I had in mind was something like this, if my object(s) looked like this in mongo:

{
  record_id: 1,
  property_1: 'some value',
  property_2: 'some value',
  users: [1, 2, 3, 4]
  ...
}

And then another one:

{
  record_id: 2,
  property_1: 'some value 2',
  property_2: 'some value 2',
  users: [1, 2]
  ...
}

Then on some page that I have I can display all the records for a given user.

But I have a requirement where I could give some users access to more records and/or to less. How would I go about doing this?

If I had a case where I would need to take away the access from x amount of records, and give access to the y amount of records, for a user. In a relational database I would do something like this :

--start transaction--
remove all access for a given user from the records
add all new access
--transaction end--

So in case user refreshes the page, he or she can only see the old data before the access for that user was updated, or the new data which would happen only after entire transaction would complete.

How do you guys do this in a mongo world? Do I change how I store the records, or the way I manage row level security per user, and manage that access?