title: Custom Authorization inside REST Service + MVC 3
body: <p>We have Implemented REST Based Architecture for our ASP.NET MVC3 App.
  We are pondering over the architectural decision to implement a custom Authorization for the contracts we are exposing through our service.</p>
  
  <p>e.g. Any valid authenticated user may get access to a particular Method implementation of the contract and might want to access some other user's info (getting a list of items from the data through Stored Proc) , we need to check after we get back this Items list that whether this authenticated User has proper permissions to access this. The permission check is based on a heavy business  logic , hence Attribute based authorization might not be helpful in this scenario as only after getting back the data we might decide the access permission check.</p>
  
  <p>Please advice how to implement this security model inside our REST Service.</p>