Netlify looks for a client-side JWT that is signed with a shared secret and contains an

app-metadata

section that defines a collection of roles.

{
  "id": "some id",
  "exp": 1602522810,
  "app_metadata": {
    "authorization": {
      "roles": [
        "admin",
        "editor"
      ]
    }
  }
}

You can then tell Netlify how to redirect the user if they don't have a JWT or they don't have the valid role. More info in the docs here: https://docs.netlify.com/visitor-access/role-based-access-control/