The system I am developing is designed to have multiple organizations, with users and roles for each organization. Some organizations can interact, some can not, and generally organizations are not allowed to see or modify each others data with some exceptions.
I have a model class A that manipulates the data storage in a permanent storage container of some kind. I have a controller class B that validates input (including access rights verification) to objects of class A.
The controller classes are in a separate library from the model classes.
All user interaction is performed from view classes which are again in a separated library (in this case exposed as web services).
However, it seems that there is a possible security risk in keeping access control logic separate from the model, since no security checks will be performed if the model is not accessed by its associated controller and is accessed instead by some other code due to some malicious attacker or programmer error.
Should I place the security logic in the same model classes weaving these concerns together or should I keep the separation as I have now?