You can attach a library that checks/validates user roles. Every form references the attached library (pll file). Or, you can put the code in pre-form or when-new-form-instance at the form level trigger area that checks/validates user permissions.