Split the existing business service layer into two business service layers for clarity

[JamesChenX]

One layer is for the common business logic without authorization, and the other layer is based on the previous layer to implement the authorization logic.

But the problem isn't that simple, because most business logic is complex, and interweaves with authorization logic and business logic. If we force to split it into two layers for concern of separation, it will take some system resources (e.g. each layer queries MongoDB just for their used resources), so we need to do some research first.