I can't seem to find enough information to solve this problem.

Scenario:
- There are two web services: ServiceA and ServiceB both have two web
methods AA(), AB() and BA(), BB() respectively
- There are two in memory associations: "ServiceA" is allowed to be accessed
by "Domain\Administrators", "ServiceB" is allowed to be accessed by
"Domain\Users", which can change at any time during runtime.
- The services are hosted via: SoapReceivers.Add(...,...) not ASP.net on IIS
- WSE3 is enabled on both the server and client, for use with Kerberos
tokens withing an intranet environment with Active Directory.

My Intended Solution:
- Upon receiving a web method call from a client the call is analysed. The
caller's role and the destination service class name is checked against the
in memory association and acted upon accordingly.
- More specifically: If a member of the Administrators group attempts to
access ServiceA, the call continues to invoke the appropriate method.
- In contrast, If a caller attempts to call ServiceA and is not part of the
Administrators group an exception is thrown.

Other useful background:
-I understand that access to web services can be controlled by editing the
wse3policyCache.config file
(policy\authorisation\allow@role="administrators"), but run time flexibility
is needed.
-I have seen and considered using a custom SecurityTokenManager, but I
couldn't see any way of obtaining the destination of the SOAP message. That
is, in the VerifyToken(SecurityToken token) procedure, I don't know how to
tell whether i'm verifying a message going to ServiceA or ServiceB.

Thanks, Toddo.