auth-policy.ts

authPolicy()
     .register("ShopOwner", ctx => {
          // ctx.user is claims of JWT token 
          // from Authorization request header
          return ctx.user?.role === "ShopOwner"
     })
     // chain to register another policy
     .register("Staff", ctx => {
          return ctx.user?.role === "Staff"
     })