So I just read Rob Conery’s blog post on Securing Your Controller Actions in MVC. I was a little perplexed about why guys at Microsoft love to reinvent stuff they have already done. I know Rob Conery is a really smart guy and has a wonderful grasp of the .NET framework, so I would have to assume he knows about what I have outlined below. My only guess is that he just wanted to re-invent something that is already built in to the framework using his own code. I personally prefer the PrincipalPermissionAttribute which has been part of the .NET framework since 1.0 and implements the CodeAccessSecurityAttribute which is used by the run time.