How to implement an authorization model for a SaaS application