title: Restrict authorization or reduce result in case specific parameter arent satisfy requirements
body: <p>Describing University via software I faced an auth issue.</p>
  
  <p>Previously I had only a <code>Headmaster</code> role, which can do and access anything.
  But as for now, I need to integrate a <code>Teacher</code> role.</p>
  
  <p>The <code>Teacher</code> role should have an option to access certain features, which could be easily restricted by <code>Authorize</code> attribute. But in some cases, I want to reduce the number of data allowed to access for this role, e.g. not all students of the universe, but the ones who study <code>Teacher's</code> <code>Subject</code>.</p>
  
  <p>All of this is already described in EF, (e.g. teacher-subject, subject-students relationships). But now I struggle to refuse (return 403) request for subject or students which are not allowed to access by <code>Teacher</code>.</p>
  
  <p>I thought about a Specification pattern usage for my Services, so the resulting data will be reduced with a Specification's filter, as it helps reduce the data amount, sometimes to no-data, but didn't help to fully refuse a request.</p>
  
  <p>Could you kindly provide me a link or an architectural idea to satisfy expectations for both use-cases specified above?</p>
  
  <pre><code>// entity models
  class Subject {
      ...
      public Teacher Teacher { get; set; }
      public List&lt;Students&gt; { get; set; }
      ...
  }
  
  class Teacher {
      ...
      public List&lt;Subject&gt; Subjects { get; set; }
      ...
  }
  class Student {
      ...
      public List&lt;Subject&gt; StudiedSubjects {get; set; }
      ...
  }
  
  // first use-case I want to solve
  public ActionResult&lt;List&lt;Student&gt;&gt; GetStudent()
  {
      // previously I just did
      return Ok(_studentsService.GetStudents());
  
      // but as for now in case of Teacher role accessed the method I want to
      // reduce the number of returned students
  }
  
  // second use-case I want to solve
  public ActionResult&lt;Subject&gt; GetSubjectDetails(int subjectId)
  {
      // previously I just did
      return Ok(_subjectService.GetSubject(subjectId);
  
      // but as for now in case of Teacher role I need to check whether its
      // allowed to get the subject and return Access denied in case its not
  }
  
  </code></pre>