[CFCDev] How smart should objects be?

[Marlon Moyer]

I have an object (company) that contains all the pertinent information/methods for viewing/updating a company profile.  Some users are only allowed to view the profile while others are given the ability to modify the information.  Should the company object accept a user object that contains permissions and roles and allows actions based on it, or should I have a security object that would call the company object?    I guess what I’m getting at is where do you put your security?  Does it make sense to embed it into objects or does that make it too complex?     Marlon