Locked down controllers based on role