This is a typical architecture scenario for a 3-tier design:
Has Graphical User Interface components
Has business logic including the following layers:
- Data Access Layer (DAL)
- Access Control
Typically your database or physical data storage
What is the best way to implement Access Control when performance is top of priority list?
- Should the DAL return ALL data and have the UI layer worry about Access Control?
- Should the DAL perform Access Control, i.e. decide with data to return, so that the UI does not worry about Access Control?
What are your thoughts on this, and what guides you when making such design decisions?