Different user can only open different forms

In my app, there are 5 forms and 2 different type of user: Admin and Operator.

Admin can open all 5 froms but Operator can only open form2 and form4.

How to control Operator only open form2 and form4?

For example, after login, Operator can change URL in URL window from

http://mywebserver/myapp/form2  to  http://mywebserver/myapp/form5 to open form5. 
...