Use of RestrictionProvider to filter access to node by glob pattern

[d yahoo p <df...@yahoo.com.INVALID>]

Hi,
I want to limit access to a node based on user profile attributes and node attributes in AEM/CQ.
My research suggests Jackrabbit-Oak's RestrictionProvider is the best approach to allow or deny access.
May I ask the group to explain or provide examples for tips, links or guidance on ,   
   - filter by user-group; and,   

   - filter by node attribute contents (glob pattern), similar to (jcr:content[attribute value]) must equal equivalent attribute in user profile   

   - how to customize rep:restrictions name (nice to have)
   - how to register & manage restrictions in CRX console
   - Assuming ONE RestrictionProvider, then aggregate then into CompositeRestrictionProvider.

==> Is someone in the group aware of related tutorials or example apps? <==
This seems like a basic feature and there is very little guidance on that I can find. 

TIA,
/Dev