i do think role based permissions would be the best practice approach there but either way good luck