 <p>Here is a stab at a solution. It needs a bit of cleanup but should give you everything you need.</p> <p>Create a custom ActionFilter, and then decorate your methods with it. </p> <pre><code>[ManagerIdAuthentication] public ActionResult Details(int id) { // Gets executed if the filter allows it to go through. } </code></pre> <p>The next class can be created in a separate library so you can include it in all your actions that require this validation.</p> <pre><code>public class ManagerIdAuthentication : ActionFilterAttribute { public override void OnActionExecuting(ActionExecutingContext filterContext) { // the next line needs improvement, only works on an httpGet since retrieves // the id from the url. Improve this line to obtain the id regardless of // the method (GET, POST, etc.) var id = filterContext.HttpContext.Request.QueryString["id"]; var employee = employeeRepository.Get(id); var user = filterContext.HttpContext.User.Identity; if (employee.managerId == user.managerId) { var res = filterContext.HttpContext.Response; res.StatusCode = 402; res.End(); filterContext.Result = new EmptyResult(); //may use content result if want to provide additional info in the error message. } else { // OK, let it through. } } } </code></pre>