This application has a MVC model. Users are assumed to be pre registered with the maximum security level he belongs and the user exists in the database. User will login to the application and try to perform different actions through the UI. Each request goes through a SecurityFilter where we have a pre defined map of <actions - required security level to do the action> . At this filter the above mentioned filtering logic will be evaluated and users new security level will be set in his session and will allow/deny the access based on the filtering result.