Have you looked at the code?  Have you looked at the Word document in the
Solution folder, that explains how it works?

The IsAuthorised() method checks the database and, in this case (for
simplicity), returns the user's role.  Obviously in real applications things
would be a bit more complex than this with users having, potentially, many
roles.

The code is decorated with attributes that check security information on
entry into protected classes/methods.

Read the Word document, and then post again with any questions you still
have.

Peter