Fisher Investments interview question

How do you handle role based authorization?