I'm working on some Role-based security for our app and I essentially want to do customized verison MVC's `AuthorizeAttribute` - but only at the business logic layer, where we don't link to MVC. 

I've looked at `PrincipalPermissionAttribute` but it seems it doesn't have a way to customize it as it's sealed. I just want to create a custom version where I can check for membership in *any* of a list of roles without using multiple attributes, and also define where to look for the role membership. 

Is there anything like this in .Net that I'm missing? Or does anybody have some insight on how to do this without reimplementing ASP.Net's AuthorizeAttribute/RoleProvider/etc?

**EDIT**

I currently have a imperative version running, but I'd rather have a declarative-attribute version, as it's easier to see it above the method/class.

Right now I have the following in an abstract base class for my business layer: 

```
protected void EnsureEditorLevelAccess()
{
    var allowedRoles = new[]
                            {
                                Roles.Administrator,
                                Roles.Editor,
                            };

    var roles = GetAccountRoles(GetCurrentUsername());

    if (roles.Any(role => allowedRoles.Contains(role)))
    {
        return;
    }

    throw new SecurityException("You do not have sufficient privileges for this operation.");
}

```

I like being able to use `Roles.Administrator` etc because the role names are hideous (Active Directory group based...), so I was thinking of wrapping those details up in the constructor of a custom attribute that I can just plop on top of classes/methods. 

`GetAccountRoles` is just a facade over an injectable role-provider property, which I can set to use either AD or a testing version that uses the database. 

I could subclass `Attribute`, but not sure how it would kick off the security check.