Where do I implement filtering based on role and another variable in .NET Core controller?

Question

I have a controller with a POST endpoint that creates a new item:

[Route("v1/users/{userId:int}/items")]
public class ItemsController
{
    private