Grant users access to controllers based on role/capability