I'm currently developing a SPA in Angular, and so I've created a REST service using ServiceStack. I am also using ServiceStack's default authentication and authorization solution, which allows me to decorate services with the `Authenticate` attribute, and also allows me to authorize roles.

However, since my application has users, and users own resources, I need a way to restrict non-authorized users from performing certain actions. Furthermore, I would like to be able to create a single service for each discrete entity which can properly figure out what is safe to write to the database and what is safe to return to the user depending on their level of authorization.

So as an example, let's say I've created a service to handle operations on a `Group` entity. One of the actions I allow on a `Group` is to get the details for it:

* Route: `api/groups/{Id}`
* Response: `Name`, `Description`, `CoverImageUrl`, `Members`

However, depending on who the user is, I wish to restrict what data is returned:

* Not authenticated: `Name`, `CoverImageUrl`
* Authenticated: `Name`, `CoverImageUrl`, `Decription`
* Member of requested group: Full access
* Admin of website: Full access

So one simple approach to doing this is to create 3 different response DTOs, one for each type of response. Then in the service itself I can check who the user is, check on their relation to the resource, and return the appropriate response. The problem with this approach is that I would be repeating myself a lot, and would be creating DTOs that are simply subsets of the "master" DTO.

For me, the ideal solution would be some way to decorate each property on the DTO with attributes like:

* `[CanRead("Admin", "Owner", "Member")]`
* `[CanWrite("Admin", "Owner")]`

Then somewhere during the request, it would limit what is written to the database based on who the user is and would only serialize the subset of the "master" DTO that the user is permitted to read.

Does anyone know how I can attain my ideal solution within ServiceStack, or perhaps something even better?