I am designing some services that I am thinking would be good to secure
using Kerberos as we have an intranet setup.  It is pretty clear how you
secure a user at the service level, but I'm curious as to how one would use
Kerberos to secure at the method level. Say I have an AD group named "MyApp"
that allows a user to access the service.  I'd also like to have another
group "MyAppAdmin" which gives a user access to more methods on the service
than the vanilla user would have.

I havent seen anything so far to suggest that the WSE helps you in my
scanario beyond providing you with the account name of the user so you can
use code to check for methods you want extra security on, whereas the
service level authentication is pretty much built in.  Is that a correct
assesment?

Thanks,
Eric