Best way to add body-based permissions check?

[misty wind]

I imagine there's a few ways to do this but I'm not sure what's best.
I've got a generic CRUD controller I use for all my entities, but some of my entities need extra permissions checks. What's the best way to extend route logic to include e.g. checking a field in the body matches some auth token claim?

I imagine this could be hamfisted with an interceptor - but my validators won't have run by then, right? I'm wondering if there are better patterns for this.

[gaunt hedge]

Validators won't run, but the parser would have. So you should be able to read a token from a body property