There ia a lot of guidance for ASP.NET security and data access model but I
don't find much information about this topic for smart clients. In a web
application the trusted subsystem is good and simple, however it is
impracticable in a smart client environment unless you use a middle-tier for
data access.

Is there any good guidance on this topic? Should we use a middle-tier or
directly connect to the database from the client? If connecting directly to
the database how to manage the fine-grained permissions on the databse
objects for each user?

Thanks

Olivier