> The custom controller needs the right set of permissions, expressed through a set of role-based access control (RBAC)–related settings.