Add action-based authorisation