I am writing a REST API service where I need to add a layer of authorization for the endpoints I provide. I implemented authorization by using discrete permission on every controller using a guard/middleware.

  @Get('/clients')
  @hasPermissions('read', 'all')
  @UseGuards(PermissionsGuard)
  async getClient(@Query() query, @Res() res) { 
      ...
  }

My question is I need to add a layer of access depending on the owner of the resource. For example, if the user has an admin previllages he/she can see clients created by everyone, however, if the user has a privilege that is lower than the admin he/she can only see a client which created by himself/herself.