 <p>I may have misinterpreted your question as your terminology is unclear.</p> <blockquote> <p>Entity E contains two kinds of entries: publicly visible entries... and private entries.</p> </blockquote> <p>Do you mean that your "entity E" (a CRM entity definition) contains publicly accessible <em>attributes</em> and private <em>attributes</em> (<strong>this is what I have assumed</strong>) or do you mean that some of the <em>records</em> that are of type "Entity E" are public and some private?</p> <hr> <p>I would recommend that you investigate the CRM 2011 "<a href="http://msdn.microsoft.com/en-us/library/gg309608.aspx" rel="nofollow">Field Level Security</a>" (FLS) concept. This allows you to secure a subset of fields and make them only available to specific users (i.e. it is <strong>not</strong> tied to a role). This security is applied to CRM views as well as forms so it should fit your scenario of having all web-based requests coming via an impersonated user.</p> <p>FLS does have a performance impact. In a high-volume scenario, you might consider moving your "private" attributes to a new entity, relating it to your original public entity and securing access to the private entity separately.</p>