The DB solution is exactly what I have in mind. The "$auth->can" call in the method call is one solution I thought about. Since this requires an additional call in the method code, I would opt for an inherited method or an additional module in SOAP::Lite, that does this work.