Controller level action authorization module