controller-6.cs

public class AdminController : Controller
{
    public ActionResult Index()
    {
        // In real production code you should probably use the AuthorizeAttribute
        // instead of authorizing/forbidding the user inside an action method
        var user = (UserProfile)ViewBag.User;
        if (!user.IsAdmin)
        {
            return new HttpStatusCodeResult(HttpStatusCode.Forbidden);
        }
        
        return View();
    }
}