title: What to apply security to in MVC + DDD + Repository Pattern project?
body: <p>I have the broad requirement for a flexible, reasonably granular security system, allowing us to customize what a given role or user is allowed to do within the system.</p>
  
  <p>Facing this requirement, I must choose what objects, classes, or items within the architecture the security should use as its building block - eg. if a role us granted access to X, then what is X? An entity, a controller action, an item in a custom list of objects etc.</p>
  
  <p>Options I am considering:</p>
  
  <p>1) Grant by CRUD action on Entities (eg. a user could be granted Create/Read/Update access to the Account entity, and Read access to the Invoice entity, etc)</p>
  
  <p>2) Grant by CRUD action on Entities , with RU actions to individual Entity Properties (eg. access to update specific fields) - could be simplified with "property groups" identified by attributes on the entities</p>
  
  <p>3) Grant by Repository &amp; Repository Function (eg. permitted to call to AccountsRepository.Get(...) or AccountsRepository.GetList(...) etc)</p>
  
  <p>4) Grant by MVC Controller + Action (eg. permitted to access /Accounts/Index or /Accounts/Update/X etc)</p>
  
  <p>5) Grant by a custom list of "Security Objects" which can be tied to arbitrary things within the architecture</p>
  
  <p>Option (5) gives the most flexibility but least generic implementation. Option (4) is attractive as the security items will closely reflect the user interface, but means that the Domain is not securing access and security would not be applied in non-web interfaces.</p>
  
  <p>What is your opinion &amp; experience designing a security pattern in MVC + DDD + Repository pattern?</p>