title: Authorization depending on user organization .net core
body: <p>I have Organization, UserType, AspNetUser,Department, Stock and SIM tables as the following <a href="https://i.stack.imgur.com/5fIlu.jpg" rel="nofollow noreferrer">schema</a></p>
  <p>when the user call the endpoint api/sims/1
  and the user type for the user is not super admin
  and the organization of the user is not the same as the organization of the sim
  i want to return unauthorized
  so what is the best practice for doing this in asp.net core web api 3.1?</p>