@guttays why are you using a before operation rule .you can also achieve this using custom authentication as well.