Well, if it helps, even with windows identity you can provide your own
roles definitions. If you can look them up from somewhere,
GenericPrincipal may be of use - alternatively create your own
IPrincipal that performs IsInRole... (perhaps prepending an NT name
onto the role per instance?)

But essentially you are going to have to store the data somewhere...

Some ideas...

Mac

using System;
using System.Security;
using System.Security.Permissions;
using System.Security.Principal;
using System.Threading;
static class Program
{
   static void Main()
   {
       string[] userRoles = { "Sales" };
       Thread.CurrentPrincipal = new
GenericPrincipal(WindowsIdentity.GetCurrent(), userRoles);
       TestSales();
       try
       {
           TestAdmin();
       }
       catch (SecurityException)
       {
           Console.WriteLine("Admin failed ;-p");
       }
   }
   [PrincipalPermission(SecurityAction.Demand, Role="Sales")]
   static void TestSales() { Console.WriteLine("Sales"); }
   [PrincipalPermission(SecurityAction.Demand, Role = "Admin")]
   static void TestAdmin() { Console.WriteLine("Admin"); }
}
// another idea for separating the data...
class SuffixPrincipal : IPrincipal
{
   private readonly IPrincipal parent;
   private readonly string roleSuffix;
   public SuffixPrincipal(IPrincipal parent, string roleSuffix)
   {
       if (parent == null) throw new ArgumentNullException("parent");
       this.parent = parent;
       this.roleSuffix = roleSuffix;
   }
   public IIdentity Identity { get { return parent.Identity; } }
   public bool IsInRole(string role)
   {
       return parent.IsInRole(role + roleSuffix);
   }
}