Implement authorization based on user groups