title: ASP.NET MVC 4 Custom Authorize Attribute with Permission Codes (without roles)
body: <p>I need to control the access to views based on users privilege levels (there are no roles, only privilege levels for CRUD operation levels assigned to users) in my MVC 4 application. </p>
  
  <p>As an example; below the AuthorizeUser will be my custom attribute and I need to use it like this:</p>
  
  <pre><code>[AuthorizeUser(AccessLevels="Read Invoice, Update Invoice")]
  public ActionResult UpdateInvoice(int invoiceId)
  {
     // some code...
     return View();
  }
  
  
  [AuthorizeUser(AccessLevels="Create Invoice")]
  public ActionResult CreateNewInvoice()
  {
    // some code...
    return View();
  }
  
  
  [AuthorizeUser(AccessLevels="Delete Invoice")]
  public ActionResult DeleteInvoice(int invoiceId)
  {
    // some code...
    return View();
  }
  </code></pre>
  
  <p>Is it possible to do it this way?</p>