You have to use policy for this. Check out strapi documentation for policy. or create custom controller.