title: Which layer of an application should keep security logic (permissions, authorization)?
body: <p>Since the most similar questions are related to ASP MVC I want to know some common right choice strategies.</p>
  
  <p>Lets try to decide, will it go into the business layer or sit on the service layer. </p>
  
  <p>Considering service layer to have a classical remote facade interface it seems to be essential just to land permission checks here as the user object instance is always here (the service session is bound to the user) and ready for <code>.hasPermission(...)</code> calls. But that looks like a business logic leak.</p>
  
  <p>In the different approach with an implementation of security checks in the business layer we pollute domain object interfaces with 'security token' arguments and similar things.</p>
  
  <p>Any suggestions how to overcome this tradeoff or maybe you know the only true solution? </p>