Hi Jeff,
 If using a database, you can create table with columns like these:

UserGroupID (or UserID) NOT NULL
ParentFormSecurityToken NULL
ChildConrolSecurityToken NULL
LinkToParentForm NULL

Then decorate each form and conrol with attribute that will tell you wether
the user has permission or not.
[HasPermissions(string SecurityToken)]
The attribute class will load the permissions for that user and check to see
if they have access.

But of course, if anyone else has a better way of doing it please chime in
because I have to implement the same thing coming up real soon :)

--Patrick

Hi, Jeff:
   Microsoft has a MVC implementation (UIPAB), but this is not the solution
for your problem, but it can help on some other things.
   I've made something like what you want to do. My suggestion is to create
your own controls, like a custom button, in a class that is derived from
standart button. This control should check something to see if it should be
enabled or not (make it customizable and extendable, using interfaces and
implementations to perform these checks)... This control SHOULD NOT access
database itself. It should call a security class, that will call a checking
class, that will call a DAL, that will access any storing place (a database,
in your case)...
   There are some tricks to create controls, but nothing really painfull.
Make some google checking for that, or ask here again if you can't find
nothing usefull (I had the source code of a retail manufacturer, so it was
easy for me to know how to do custom controls)...

   Good luck,
       Ravi Wallau.

You can create a base page class as well...
This class should NOT BE abstract in any case...