I have been reading a lot about asp.net membership and roles for the past couple of days and trying implement it in my project using form based authentication. I tried out most of the samples that I found on the internet from managing user/roles using WSAT to managing urser/roles/access rules in code. No doubt it provides great functionality with little effort on developer's end but some how I have developed the feeling that authorization in asp.net only provides a way to restrict access to pages and directories. What if I have a page which can be accessed by all users and based on the user role, the page offer different functionality to the user (common scenario - like SO is using). Though we can check `Roles.IsUserInRole(role)` in our code and customize the page for different roles but then again we can code the functionality to create more roles and enable users (Admins) to create more. And once the application is up and running, users (admins) create new roles, how do we take care of such roles in our pages?