title: Is ASP.NET role based security a true role based access control system?
body: <p>From what i have read from <a href="https://docs.google.com/viewer?a=v&amp;q=cache%3aC42MYHJHjgsJ%3aciteseerx.ist.psu.edu/viewdoc/download?doi%3D10.1.1.84.9866%26rep%3Drep1%26type%3Dpdf+In+Proceedingsof+the+International+Conference+on+Engineering+ComplexComputing+Systems+%28ICECCS+2002%29,+Greenbelt,+MD,December+2002.+ACM+Press.&amp;hl=en&amp;gl=in&amp;pid=bl&amp;srcid=ADGEESjjfqWJhL1iYnn_c8OhK2HkK2Qam-hkfWDW-lpszXERVdAKnjOoEtS_kH9xA8cEWkonK0k1caoTOc-icf8Er25t9x8oBsU2voE4v2YgTwLAHvzPkvundMqGLRz-V00AgbRWAOAe&amp;sig=AHIEtbQJfwI7wDVbjJtSniH3nDrtIDp4rg&amp;pli=1" rel="nofollow">this paper</a>
  I understand that a role based access control system is one where users can be assigned to roles where roles specify permissions to perform operations on objects
  But in asp.net we do not specify "Operations on objects", what i mean here is that how can we specify "All users in Role R can perform a delete on object O"
  Where is the Object Part in ASP.Net</p>