当用户权限基于特定帐户/角色以外的其他内容时,定制用户授权的最佳方法是什么?

public class PointAuthorizeAttribute : AuthorizeAttribute
{
    public int PointsRequired { get; set; }

    protected override bool AuthorizeCore( HttpContextBase httpContext )
    {
         if (base.AuthorizeCore( httpContext ))
         {
             var name = httpContext.User.Identity.Name;
             using (var db = new SomeDataContext())
             {
                 var userPoints = db.Users
                                    .Where( u => u.UserName == name )
                                    .Select( u => u.Points )
                                    .SingleOrDefault();
             }
             return (userPoints >= PointsRequired);
         }
         return false;
    }
}

用作

[PointAuthorize( PointsRequired = 50 )]
public ActionResult Comment( string comment )
{
}