title: ASP.NET MVC Custom Authorization
body: <p>I have a question about custom authorization in MVC.</p>
  
  <p>I have a site that I want to limit access to certain pages, depending on their group membership.  Now I have seen tons of examples on how to do this if there is a single admin group and a single user group, for example, but not any examples for a third level.  </p>
  
  <p>For example, only users of a company can view orders for their own company (and each company has its own admins, etc).  These companies are stored in a DB.  So I have seen ways to do custom authorization, overriding the <code>AuthorizeCore</code> method on the <code>AuthorizeAttribute</code>, but I don't know how to access to the parameters passed into the controller to see if the user has access to the order (order id, for example).  </p>
  
  <p>Is this even the best place to do the check, or should this just be handled directly from the method of the controller?</p>