[Authorize(Roles="admin")]
public ActionResult Create() {
   ...
}