Server:
- AuthorizationService <- SystemUserService, CommandService
	- UserIsAuthorizedForCommand
- SystemRoleService <- CommandService, SystemUserService
	- GetAllSystemRoles
	- GetSystemRoleByCode
	- GetCommandsForSystemRole
	- GetSystemUsersForSystemRole (nødvendig?
	- annen DML?
- CommandService (SecurableService?) <- SystemRoleService, SystemUserService
	- GetAllCommands
	- GetCommandByCode
	- GetSystemRolesForCommand
	- ingen DML her
- SystemUserService <- CommandService, SystemRoleService
	- GetAllSystemUsers
	- GetSystemUserByUserName
	- GetCommandsForSystemUser
	- GetSystemRolesForSystemUser (nødvendig?
	- annen DML?

Client:
- AuthorizationManager <- AuthorizationService, CommandService, SystemUserService, SystemRoleService
	- UserHasAccess(command) (bruker innlogget bruker)
	- UserHasAccess(command, user)
	- RoleHasAccess(command, role) (kanskje ikke nødvendig)
- Aspects:
	- FormAuthorizationAspect (UnauthorizedAccessException hvis ingen tilgang)
	- UserControlAuthorizationAspect (skjuler elementet hvis ingen tilgang; antakelig litt vanskelig å gjøre generelt)
	- generelt AuthorizationAspect som kan konfigureres til å gjøre forskjellige ting?