The first stage of our "modern auth" project just landed in our development branch: a new flexible roles/permissions system for Prosody.
If you use trunk nightly builds, or develop plugins for Prosody, you need to be aware that some APIs have been deprecated and will be removed before the next major release.
Lots more detail about the new changes in our blog post: https://blog-draft.prosody.im/role-auth/