Create the ACL attribute

public class AclAttribute : AuthorizeAttribute
{
    string _notAllowRoles;
    string _allowActions;

    /// <summary>
    /// Set the ACL attribute for access right
    /// </summary>
    /// <param name="NotAllowRoles">Not allow roles, split with comma</param>
    /// <param name="AllowActions">Set the actions allow for the restrict roles</param>
    public AclAttribute(string NotAllowRoles, string AllowActions = null)
    {
        _notAllowRoles = NotAllowRoles;
        _allowActions = AllowActions;
    }

    public AclAttribute() : base()
    {

    }
}