We do it through code and userlevel flags.

We have a user table in our SQL Server and each person in the user table is assigned a userlevel. Based on that user level they can perform, or are restricted from performing, certain features within the application.

It is very easy to upgrade or down grade a user level. We do that straight through Enterprise Manager and none of our code needs to be changed at all.