 <p>That all sounds fine - though I'd opt for something more granular: something that would allow access to other people's records on an access-control-list basis, but that's more complicated.</p> <p>The only thing I'd change in what you've written is the "redirection" to an access-denied page. <strong>Never perform redirections to error pages</strong> - instead return the error message in the original response. You can do this in ASP.NET WebForms by using <code>Server.Transfer</code>, or by clearing the response buffer (if necessary) and setting the page content to an ASCX with the right message. Don't forget to set the HTTP status to 403.</p>