what's the best practice for the following requirement

I’ve soap ws with three operations add, delete and update. It needs to authenticate Two things First client id that will be sent in request body using AAA action if true then second will check the privilege on allowed operations for that client

DataPower AAA action allows to use custom stylesheet for features that cannot be selected directly from the list of methods provided.