How to best ensure an employee can only access resources from their own company, department etc. in an ASP.NET MVC app
I am wondering how to best ensure that an employee cannot access information from another company). This is not an authentication / roles based question on applying roles or permissions to actions, but rather ensuring that the data somebody is try to access actually belongs to them.

Users belong to a department which in turn belongs to a company. In the below example the calendar belongs to a company. How do I ensure that the user can only edit calendars within their own company.

    public ActionResult Edit(int? calendarId)
    {
           ...
    }

**Approach 1**

    public ActionResult Edit(int? calendarId)
    {
        // get company that calendar belongs to
        int calCompanyId = ..
        if (CurrentUser.CompanyId != calCompanyId)
            return RedirectToAction(....); // cannot access resource

           ...
    }

Whilst this would work, I'm wondering if there is a better way to handle this sort of problem. Possibly that wouldn't require putting in checks for every single action across all controllers like this.

**Alternate Solutions??**
How to best ensure an employee can only access resources from their own company, department etc. in an ASP.NET MVC app
===

I am wondering how to best ensure that an employee cannot access information from another company). This is not an authentication / roles based question on applying roles or permissions to actions, but rather ensuring that the data somebody is try to access actually belongs to them.

Users belong to a department which in turn belongs to a company. In the below example the calendar belongs to a company. How do I ensure that the user can only edit calendars within their own company.

    public ActionResult Edit(int? calendarId)
    {
           ...
    }

**Approach 1**

    public ActionResult Edit(int? calendarId)
    {
        // get company that calendar belongs to
        int calCompanyId = ..
        if (CurrentUser.CompanyId != calCompanyId)
            return RedirectToAction(....); // cannot access resource

           ...
    }

Whilst this would work, I'm wondering if there is a better way to handle this sort of problem. Possibly that wouldn't require putting in checks for every single action across all controllers like this.

**Alternate Solutions??**