I've never seen this done but I had an idea of doing authorization in a more purely OO way. For each method that requires authorization we associate a delegate. During initialization of the class we wire up the delegates so that they point to the appropriate method (based on the user's rights). For example:

class User
{
    private deleteMemberDelegate deleteMember;

    public StatusMessage DeleteMember(Member member)
    {
        if(deleteMember != null)
        {
            deleteMember(member);
        }
    }

    //other methods defined similarly...

    User(string name, string password) //cstor.
    {
        //wire up delegates based on user's rights. 
        //Thus we handle authentication and authorization in the same method.
    }

}

This way the client code never has to explictly check whether or not a user is in a role, it just calls the method. Of course each method should return a status message so that we know if and why it failed.

Thoughts?