Whether probably on ACL to create dynamic assignment of the rights?

Question

Node.js

Good afternoon
It is necessary to allow users to open their profile (with read, add, update) to other users by invitation.
If it is possible on ACL - then do not tell me the algorithm?
In mongo, I create in the profile model a list of those "who can" and ....?