title: Document-Based Security in ASP.NET MVC
body: <p>I already know about User and Role-based security in ASP.NET MVC.  But now I need something a little more granular.</p>
  
  <p>Let's say I have a list of documents, some of which the user is authorized for, some not.  Each document has a corresponding record in a documents table in a database. Documents can be downloaded for viewing, if the user has security access. Documents can also be added, if you have the role.  Each document has an URL, and each document list has an URL.</p>
  
  <p>I would like to security trim the list so that the user only sees those documents for which he is authorized.  But I also need to authenticate the URL requests for these lists and documents, since there is nothing preventing a user from bookmarking a document they no longer have access to, or simply typing the URL into the browser.</p>
  
  <p>Is the built-in role-based security model suitable for this, or do I need to create separate, table-based security?  Can I put the security in my repository, so that the returned records are already trimmed, or should it be part of the controller?  Do I need a security attribute to validate the controller request, or should I just put it in the controller method as the first few lines of code?</p>