Initial implementation of authorization based on roles