TLDR;Where and possibly how should I implement scope based logic in the  example code?I have got a ASP.NET Web Api.The Api uses OData (on top off REST) for data endpoints and OAuth 2.0 authentication.Now I want to add functionality to handle an Access Token in several different scopes.Some of the scopes are:UserOrganizationCustomerThe result set the API returns should be based on this scope.The same applies if someone wants to add, update or delete an entity.Now take for example the following endpoint:http://myapi/EmployeesSomeone with a Token in the Organization scope does a GET and should only get the employees that are in the Organization that is defined within the Token. An user in the Customer scope should get the employees for all organizations within the customer defined in the Token. This functionality however is not available for someone with a Token in the User scope. The same applies to a POST. Someone within the organization scope should only be allowed to add a new employee to his own organization.The functionality for the different scopes will usually only differ a little bit.In the case of getting the employees the difference is only a where on organization or otherwise on customer. In the case of a post their should be a check to see if for example the organization is part of the customer that is bound to the customer Token.Current implementation:Currently we have a base ApiController which is generic typed.The base controller calls an Query or CommandHandler with the entity type and all the implementation details are inside this handlers.ApiControllerpublic abstract class ApiController<TEntity> : EntitySetController<TEntity, Guid>    where TEntity : class, IApiEntity{    protected readonly IQueryProcessor QueryProcessor;    protected readonly ICommandProcessor CommandProcessor;    protected ApiController(IQueryProcessor queryProcessor, ICommandProcessor commandProcessor)    {        this.QueryProcessor = queryProcessor;        this.CommandProcessor = commandProcessor;    }    [HttpGet]          public override IQueryable<TEntity> Get()    {        var command = new GetEntityCommand<TEntity>();        return this.QueryProcessor.Process(command);    }}EmployeeControllerpublic class EmployeeController : ApiController<Employee>{ }GetEmployeeHandlerpublic class GetEmployeeCommandHandler : IQueryHandler<GetEntityCommand<Employee>, IQueryable<Employee>>{    public IQueryable<Employee> Handle(GetEntityCommand<Employee> command)    {             // Code that knows how to get a collection of employees.         // This collection contains all employees    }}   PostEmployeeHandlerpublic class PostEmployeeCommandHandler : ICommandHandler<PostEntityCommand<Employee>, Employee>{   public Employee Handle(PostEntityCommand<Employee> command)    {             // Code that knows how to add an employee to the database.    }} The questionWhere and possibly how should I implement the scope based logic?I know there has to be a smart way to do this and a good place to implement this scope based logic, I just don't see it (yet).
API - How to handle scope based functionality?
design;design patterns;separation of concerns;aspect oriented