Oh, the system that will be used in .net mvc? So far I've only seen that permissions and roles can be modeled with claims, but could that not lead to the same problem like with roles (e.g user.hasClaim("foo") || user.hasClaim("bar") || ...)?

For ASP.NET MVC I use to roll my own AuthorizeAttribute (just inherit it and overload OnAuthorization). I avoid dealing with IIdentity and IPrincipal, I find it sorta messy.

Looks like things are different on vNext though: http://docs.asp.net/en/latest/security/authorization/index.h...