http://ayende.comAyende @ RahienCopyright (C) Ayende Rahien 2004 - 2021 (c) 202660Richard, very good explanation, but what is the reference to the view? http://ayende.com/2449/interview-questions-from-hell#comment4http://ayende.com/2449/interview-questions-from-hell#comment4Mon, 28 May 2007 16:50:19 GMTYou don't want to return orders beyond the scope of the aggregate boundary root, for security reasons ... so passing a reference to the name of the view, "Order.View", a predicate and a delegate, I'm guessing SecureFindAll loads the Order.View component with all the Orders for the CurrentUser, the delegate being passed internally to some repository via a query. The predicate and delegate are the select and where conditions of the query, I guess you're using ActiveRecord or NHiberate, I am not sure. Since you are handling all the query and retrieval of the data in the SecureFindAll method then it is part of a controller that manages the view. You need to pass the name of the view because you have to tell SecureFindAll what the view variations are for authorized versus unauthorized users. So you probably want to do something like this code: [Layout("default")] public class OrdersController : ARSmartDispatcherController { public void ListOrders(bool isAjax) { PropertyBag["orders"] = (IList)Order.SecureFindAll("Order.View", Where.Order.Customer.User == CurrentUser, delegate(Order order) { return order.Customer }); } http://ayende.com/2449/interview-questions-from-hell#comment3http://ayende.com/2449/interview-questions-from-hell#comment3Mon, 28 May 2007 15:21:04 GMTThat is my liberal sense of the English language, I meant Juxtapose. No idea how I got the spelling like that, though. Fixed, thanks. http://ayende.com/2449/interview-questions-from-hell#comment2http://ayende.com/2449/interview-questions-from-hell#comment2Mon, 28 May 2007 07:09:31 GMTWhat's justfox? http://ayende.com/2449/interview-questions-from-hell#comment1http://ayende.com/2449/interview-questions-from-hell#comment1Mon, 28 May 2007 07:02:52 GMT