tcollins wrote:
I am thinking about doing something like this.  How did this work out for you?  Can you share anything that you have discovered?
Thanks
I thinked around, and decided to put this logic into DAO layer.
I can rely on features of IoC containers for  enforcing role based security ( i.e. answer to the question "does this user has this role" ) - 
it can be done in completely non-intrucive way. 
But I do not have good solution ( say: non intrusive )  to answer question "does this user owns this object"
regards,