Authorization base on user roles

I think authorization base on user roles is more relative, as like add menus by roles.