I tend to agree with olalonde. What you&#x27;ve described is a well accepted method to handle authorization (sounds like you&#x27;ve implemented role-based access control). But for things like, can&#x27;t delete yourself, etc., those in my mind are business rules and not authorization rules. In fact that&#x27;s a validation rule and not authorization rule.