You treat database roles as user groups (admin/employee) and based on that define table(view) level access. Then whenever a request is made, your api code switches to the appropriate role and sends to the database the specific user id (CUGs for example). Then you use views/RLS to filter access to specific rows.