We are working on an existing application, at least 15 or 20 years old more than 2000000 lines of code and we want...

We are working on an existing application, at least 15 or 20 years old more than 2000000 lines of code and we want to add user authorization. Visual components should be visible and or enabled based on authorization, methods should be allowed based on authorization.

I remember reading about authorization implemented with attributes and (i think) aspect oriented programming but cannot find the article any more.

How would you try to implemented this in a big existing pile of code... not always optimally structured? Where can i find more info on this?