I am developing a general database query tools, a .Net 3.5 Windows Form application. In order to make the presentation layer is independent of the database layer. I use an ORM framework, XPO from DevExpress.

But, I have no access control function built in. I surfed Internet and I found in WCF Data Services, there is an interesting concept, Interceptor, which is following AOP(Aspect Oriented Programming).

I am wondering who has such an experience to build access control in ORM. My basic requirement is :

1. It should be a general method and controlled by users in runtime. So any hard coding is not acceptable.
2. It could be based on attribute, database table, or even an external assembly.

I am willing to buy a ready solution. According to the idea of AOP, an access control function can be integrated with existing functions easily and nearly not knowingly to the previous developer;)

Any suggestions are welcome.