title: Best design pattern to control permissions on a "per object per user" basis with ServiceStack?
body: <p>I know that ServiceStack provides a RequiredRole attribute to control permissions, however, this does not fully work for my use case. I have a website with a lot of user-generated content. Users can only edit documents they have explicit permissions to. Permissions are controlled per object or group of the object. So, if a user is an admin of a group then they can edit all documents managed by that group.</p>
  
  <p>What is the best design pattern to control access to a request on a <code>per object per user</code> basis? I want to approach this with as DRY a methodology as possible as it will affect 95% of all my API endpoints.</p>
  
  <p>Also, can this be integrated with FluentValidation and return appropriate HTTP responses?</p>
  
  <p>Many thanks,</p>
  
  <p>Richard.</p>