diff --git a/bun.lock b/bun.lock
index b6790f7..3d10b4b 100644
--- a/bun.lock
+++ b/bun.lock
@@ -19,6 +19,7 @@
         "mock-aws-s3": "^4.0.2",
         "nock": "^14.0.4",
         "ua-parser-js": "^2.0.3",
+        "zod": "^4.0.5",
       },
       "devDependencies": {
         "@eslint/js": "^9.29.0",
@@ -833,6 +834,8 @@
 
     "yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
 
+    "zod": ["zod@4.0.5", "", {}, "sha512-/5UuuRPStvHXu7RS+gmvRf4NXrNxpSllGwDnCBcJZtQsKrviYXm54yDGV2KYNLT5kq0lHGcl7lqWJLgSaG+tgA=="],
+
     "@commitlint/config-validator/ajv": ["ajv@8.17.1", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g=="],
 
     "@commitlint/load/chalk": ["chalk@5.4.1", "", {}, "sha512-zgVZuo2WcZgfUEmsn6eO3kINexW8RAE4maiQ8QNs8CtpPCSyMiYsULR3HQYkm3w8FIA3SberyMJMSldGsW+U3w=="],
diff --git a/package.json b/package.json
index d6488ba..135fa1b 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,8 @@
     "mime-types": "^3.0.1",
     "mock-aws-s3": "^4.0.2",
     "nock": "^14.0.4",
-    "ua-parser-js": "^2.0.3"
+    "ua-parser-js": "^2.0.3",
+    "zod": "^4.0.5"
   },
   "devDependencies": {
     "@eslint/js": "^9.29.0",
diff --git a/src/modules/userRole/controller/UserRoleAssignment.controller.ts b/src/modules/userRole/controller/UserRoleAssignment.controller.ts
new file mode 100644
index 0000000..b1ce329
--- /dev/null
+++ b/src/modules/userRole/controller/UserRoleAssignment.controller.ts
@@ -0,0 +1,16 @@
+import { Context } from "elysia";
+import { UserRoleAssignmentSchema } from "../schemas/UserRoleAssignment.schema";
+import { returnErrorResponse } from "../../../helpers/callback/httpResponse";
+
+export const UserRoleAssignmentController = async (ctx: Context) => {
+  const validation = UserRoleAssignmentSchema.safeParse(ctx.body);
+  //   if (!validation.success)
+  //     return returnErrorResponse(
+  //       ctx.set,
+  //       400,
+  //       "Validation error",
+  //       validation.error
+  //     );
+
+  return ctx.body;
+};
diff --git a/src/modules/userRole/controller/createUserRole.controller.ts b/src/modules/userRole/controller/createUserRole.controller.ts
index 726522d..bf0e5f5 100644
--- a/src/modules/userRole/controller/createUserRole.controller.ts
+++ b/src/modules/userRole/controller/createUserRole.controller.ts
@@ -7,6 +7,8 @@ import {
 import { createUserRoleService } from "../services/createUserRole.service";
 import { mainErrorHandler } from "../../../helpers/error/handler";
 import { createUserRoleSchema } from "../schemas/createUserRole.schema";
+import { getCookie } from "../../../helpers/http/userHeader/cookies/getCookies";
+import { jwtDecode } from "../../../helpers/http/jwt/decode";
 
 /**
  * @function createUserRole
@@ -41,16 +43,28 @@ import { createUserRoleSchema } from "../schemas/createUserRole.schema";
  *   "canManageSystem": false
  * }
  */
-export const createUserRole = async (
+export const createUserRoleController = async (
   ctx: Context & { body: Prisma.UserRoleUncheckedCreateInput }
 ) => {
+  // Validation input form with schema
   const { error } = createUserRoleSchema.validate(ctx.body);
   if (error)
     return returnErrorResponse(ctx.set, 400, "Invalid user input", error);
 
+  // Delete this, use middleware instead!!!
+  const cookie = getCookie(ctx);
+  if (!cookie.auth_token)
+    return returnErrorResponse(
+      ctx.set,
+      403,
+      "Forbidden, You don't have access to this resouce"
+    );
+
+  const jwtSession = jwtDecode(cookie.auth_token);
+
   const formData: Prisma.UserRoleUncheckedCreateInput = {
     ...ctx.body,
-    createdBy: "daw",
+    createdBy: jwtSession.userId,
   };
 
   try {
diff --git a/src/modules/userRole/index.ts b/src/modules/userRole/index.ts
index 606db28..10bc856 100644
--- a/src/modules/userRole/index.ts
+++ b/src/modules/userRole/index.ts
@@ -1,9 +1,11 @@
 import Elysia from "elysia";
-import { createUserRole } from "./controller/createUserRole.controller";
+import { createUserRoleController } from "./controller/createUserRole.controller";
 import { unautenticatedMiddleware } from "../../middleware/auth/unauthenticated.middleware";
+import { UserRoleAssignmentController } from "./controller/UserRoleAssignment.controller";
 
 export const userRoleModule = new Elysia({ prefix: "/roles" })
   .get("/", () => "Hello User Role Module", {
     beforeHandle: unautenticatedMiddleware,
   })
-  .post("/", createUserRole);
+  .post("/", createUserRoleController)
+  .post("/assign", UserRoleAssignmentController); // need fix and it just for development only!
diff --git a/src/modules/userRole/schemas/UserRoleAssignment.schema.ts b/src/modules/userRole/schemas/UserRoleAssignment.schema.ts
new file mode 100644
index 0000000..d2996ef
--- /dev/null
+++ b/src/modules/userRole/schemas/UserRoleAssignment.schema.ts
@@ -0,0 +1,6 @@
+import z from "zod";
+
+export const UserRoleAssignmentSchema = z.object({
+  userId: z.string(),
+  roleId: z.string(),
+});