Add authorisation based on role