One of the things that I briefly mentioned in this post was the idea that because Data Services sits atop of WCF you can plug in a ServiceAuthorizationManager which gets a chance to look at every request before it gets dispatched into your data service.

Whilst you can write explicit interceptors that pick up CRUD operations for particular entities, you might want to just have some roles such as createRole, readRole, updateRole, deleteRole and it'd be a bit painful to have to write lots of interceptor methods to enforce this.

That is, it'd be nice if Data Services had a single place where you could inject code to run before (and possibly after) each operation but I don't think it has one in the current CTP.

A ServiceAuthorizationManager implementation might help a little here though. I might do something like this to try and determine who it is that's calling my service and whether I allow them to do it based on a role;

public class AuthManager : ServiceAuthorizationManager
{
  static AuthManager()
  {
    // Probably want these defined externally...
    roleMap = new Dictionary<string, string>();
    roleMap.Add(httpGet, "readRole");
    roleMap.Add(httpPost, "createRole");
    roleMap.Add(httpPut, "updateRole");
    roleMap.Add(httpDelete, "deleteRole");
  }
  protected override bool CheckAccessCore(OperationContext operationContext)
  {
    bool authorised = false;

    WebOperationContext webCtx = WebOperationContext.Current;
    HttpContext ctx = HttpContext.Current;

    if (ctx != null)
    {
      IPrincipal principal = ctx.User;

      string roleName = null;

      if ((principal != null) && roleMap.TryGetValue(
        webCtx.IncomingRequest.Method.ToUpper(), out roleName))
      {
        authorised = principal.IsInRole(roleName);
      }
    }
    return (authorised);
  }
  private static Dictionary<string, string> roleMap;

  // Pretty sure these are defined somewhere else...
  private const string httpPost = "POST";
  private const string httpPut = "PUT";
  private const string httpGet = "GET";
  private const string httpDelete = "DELETE";
}

and then that'd be configured just like it was in the previous post.