You can use ASP.NET Identity for user and role management , and when roles are used to enforce access restrictions within our application, they are basically hard-coded, usually via the [Authorize] attribute. Please refer to below
link for more details and code sample :