So I want to create a custom authorization that takes in BranchId, StaffId and RoleId. The Staff can only be allowed to view the his branch only when logging in to the appli