Most web apps perform authorisation checks at the controller layer. This is basically ok, but complex apps tend to have repetitive checks. For example, there might be ten or so controller actions that operate on an Order, and every action needs to check that the current User is authorised to access that Order.
Some apps deal with this by having helper functions on Order, e.g. Order.isUserAuthz() and this does reduce code bloat. However, there is still the risk that a particular controller method forgets to call that function. From my experience pen testing, this is fairly common in complex apps.
Instead, how about having the model layer perform the authorisation check? So when you load an Order, it will only load if the current user is authorised. Because this is done by the model layer, there's no risk of the controller layer forgetting to make a call. Ultimately, what you're doing is reducing the amount of security-critical code, which reduces the risk of a coding error causing a vulnerability.
This seems like a good idea to me, but it is not common practice. Have you any thoughts on risks it could pose, or implementation difficulties?