I have a controller, `foo`, that handles a GET request to `foo/bars` by responding with a collection of `bar` objects. I would like my custom `AuthorizationHandler` and controller to work together to ensure that when a user that has permission to see bars with an ID of 1, 2 and 3 but not 4, 5, and 6 the controller returns the correct subset of `bar` objects.

This is a dotnet core 2.2 webApi. The request will have an access token in the `Authorization` header as a Bearer token. The access token will have appropriate claims to make the decision. What is the best way to use the Authorization process to create the filter the controller must apply when retrieving the list of `bar`s from the data source?