I use a roles based approach .. I check the user for Role .. and role is a ENUM of Admin, Follower, etc that is granted through authorization