https://github.com/scottkf/ability-js Like canCan for rails. This is a traditional controller / function type permission system. May be too abstract.
https://github.com/dresende/node-roles More traditional setRole() hasRole() based checking. Last activity 2 years ago.
https://github.com/carlos8f/node-relations Natural language style roles. Looks very promising and is in active development
https://github.com/ForbesLindesay/connect-roles Simple and closer to action / natural language based. Requires writing your own checks for each.
https://github.com/ajlopez/SimplePermissions Maybe too simple? Makes sense for assigning roles but then its hard to check against roles!