>>If the field name exist in the userfield table, I use the refresh method to enable or disable the control.
>
>There's a large overhead in table access (admittedly something VFP is very good at) which worries me.
>
>If every time a form is refreshed, every control is going to read the security table and enable/disable itself I would expect it to slow down performance.
>
>I am trying to keep it all in the Init() method, once controls are secured the user can't log out and log in without closing the form - so security levels won't change while a form exists.

that makes sense. another option (if time is short) and you know the login level for your fields could be to add a property (isAvail) to your text boxes, etc. and add to the init of the base a routine to enable only if the user login level is less than or equal to this property. so sysAdmin=0 can see everything, user=1 can see anything not set as sysAdmin only, etc.