How would you answer an interview scenario involving authentication and authorization in Web API?

Users may edit only their own profile while admins may edit any profile. Explain how you would enforce it.