I don't think you are missing anything. The fact that security in .NET IS NOT wrapped up into application-specific details is why it is a preferrable/superior architecture to what could be accomplished in VFP. Could you approximate it in VFP? I suppose...but you would have to roll your own - quite expensive solution...