My colleague Curt Devlin has written a great article on enterprise authorization.  This is a really thorny problem that is going to get worse as enterprises become more and more virtual.