Where does apply rules of application

This question is about applying rules of my application that confuse me.

My controller is using service and the service is using repository.

public class CommentController: ApiController{

    [HttpPost]
    public bool EditComment(Comment comment){
        commentService.Update(comment);
    }
}

public class CommentService{
    ICommentRepository repository;
    ....
    ....
    public void Update(Comment comment){
        repository.Update(comment);
    }
}

If the user is authenticated, he can update a comment.

• But a user should edit own comments.
• But an admin can edit all comments.
• But comment can not edit after a specified date.
• Edit by a department

And I have something like these rules.

I am confused a bit about where can I apply the rules. In controller or in service or in repository.

Is there any standart way to do this like design patterns.