I need to R&D to check if I can implement cache strategy to store permissions in the cache, because every time it is searching all controllers and it will reduce the performance.
We don't need to check permissions every time, we just need to update permissions list if the application restarts (if any controller add to the application)
Maybe using Redis or In-Memory (Redis is preferable)