I have a system which has role based access system.
When the API is called, first the user is authenticated, then I further verify if the user has an access to the en