. "Finding out if the user is in a role is not particularly useful, because the application really needs to call some sort of HasPermission() method." . . .