Role-based authorization check (#529)