>If the field name exist in the userfield table, I use the refresh method to enable or disable the control.

There's a large overhead in table access (admittedly something VFP is very good at) which worries me.

If every time a form is refreshed, every control is going to read the security table and enable/disable itself I would expect it to slow down performance.

I am trying to keep it all in the Init() method, once controls are secured the user can't log out and log in without closing the form - so security levels won't change while a form exists.