How to implement user roles and control which endpoints and data they can access.