How to implement a situation where access to a resource is available to all users of a certain role, but some data should be hidden or masked, for example salaries?