Don’t Do Role-Based Authorization Checks; Do Activity-Based Checkslostechies.com1 pointjoeyespo14 years ago