[patates]

If your controllers are asp.net mvc controllers you can decorate them with permission attributes (see the relevant docs for your version).

Pretty sure most frameworks have a way to structure your code for permission checking.