diff --git a/app/Config/Routes.php b/app/Config/Routes.php
index 230b321..3d59708 100755
--- a/app/Config/Routes.php
+++ b/app/Config/Routes.php
@@ -28,7 +28,7 @@ $routes->group('api', ['filter' => 'appSignature'], function ($routes) {
 
 
 //api's with token
- $routes->group('api', ['filter' => ["jwtAuth","appSignature"] ], function ($routes) {
+ $routes->group('api', ['filter' => ["jwtAuth:1,2,3,agent","appSignature"] ], function ($routes) {
 
     //logout
     $routes->get('auth/logout', 'StaffAuthController::logout');
diff --git a/app/Filters/JwtAuthFilter.php b/app/Filters/JwtAuthFilter.php
index b33a502..2ee721f 100644
--- a/app/Filters/JwtAuthFilter.php
+++ b/app/Filters/JwtAuthFilter.php
@@ -25,9 +25,23 @@ class JwtAuthFilter implements FilterInterface
             return service('response')->setJSON(['status' => 401, 'message' => 'Invalid or expired token'])->setStatusCode(401);
         }
 
-        // ⚙️ Extract date info from token
+        // Extract date info from token
         $userId = $decodedToken['data']->id ?? null;
         $lastLogin = $decodedToken['data']->last_login_datetime ?? null;
+        $role = $decodedToken['data']->role_id ?? 'agent';
+
+        // Role-based restriction (if $arguments are passed)
+        if ($arguments && isset($role)) {
+            $allowedRoles = array_map('strtolower', array_map('trim', $arguments));
+            $userRole = strtolower(trim($role));
+        
+            if (!in_array($userRole, $allowedRoles)) {
+                return service('response')->setJSON([
+                    'status' => 401, 
+                    'message' => 'Access denied. You do not have permission.'
+                ])->setStatusCode(401);
+            }
+        }
 
         if ($userId && $lastLogin) {