Im working on next kbmMW version. It will include a new sophisticated authorization framework, which allow for defining actors (users), roles, and resources (real and virtual) and resource groups. Authorizations are then granted or denied for an actor and/or a role on a resource. Constraints can be defined on an authorization (grant or deny) which for example limits the authorization to a specific day or time or range, communication via a specific transport or only from specific client nodes etc. Custom constraints can be defined. Resources, roles and actors can be defined within code, or a database or from other external resources, of which an XML storage is directly supported. And the best of it all, is that its dead easy to use and integrates directly with kbmMWs existing token based authorization scheme. Further it supports defining internal users, which can not be used for logging on from an external client, and its also supported assuming another user identity within the busines...