diff --git a/.gitignore b/.gitignore
index fb25bb9..188ef61 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,4 +28,5 @@ _ReSharper*/
 [Tt]est[Rr]esult*
 *.vssscc
 $tf*/
-packages*/
\ No newline at end of file
+packages*/
+/.vs/config
diff --git a/.nuget/NuGet.Config b/.nuget/NuGet.Config
new file mode 100644
index 0000000..67f8ea0
--- /dev/null
+++ b/.nuget/NuGet.Config
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <solution>
+    <add key="disableSourceControlIntegration" value="true" />
+  </solution>
+</configuration>
\ No newline at end of file
diff --git a/.nuget/NuGet.exe b/.nuget/NuGet.exe
new file mode 100644
index 0000000..8dd7e45
Binary files /dev/null and b/.nuget/NuGet.exe differ
diff --git a/.nuget/NuGet.targets b/.nuget/NuGet.targets
new file mode 100644
index 0000000..3f8c37b
--- /dev/null
+++ b/.nuget/NuGet.targets
@@ -0,0 +1,144 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+    <PropertyGroup>
+        <SolutionDir Condition="$(SolutionDir) == '' Or $(SolutionDir) == '*Undefined*'">$(MSBuildProjectDirectory)\..\</SolutionDir>
+
+        <!-- Enable the restore command to run before builds -->
+        <RestorePackages Condition="  '$(RestorePackages)' == '' ">false</RestorePackages>
+
+        <!-- Property that enables building a package from a project -->
+        <BuildPackage Condition=" '$(BuildPackage)' == '' ">false</BuildPackage>
+
+        <!-- Determines if package restore consent is required to restore packages -->
+        <RequireRestoreConsent Condition=" '$(RequireRestoreConsent)' != 'false' ">true</RequireRestoreConsent>
+
+        <!-- Download NuGet.exe if it does not already exist -->
+        <DownloadNuGetExe Condition=" '$(DownloadNuGetExe)' == '' ">false</DownloadNuGetExe>
+    </PropertyGroup>
+
+    <ItemGroup Condition=" '$(PackageSources)' == '' ">
+        <!-- Package sources used to restore packages. By default, registered sources under %APPDATA%\NuGet\NuGet.Config will be used -->
+        <!-- The official NuGet package source (https://www.nuget.org/api/v2/) will be excluded if package sources are specified and it does not appear in the list -->
+        <!--
+            <PackageSource Include="https://www.nuget.org/api/v2/" />
+            <PackageSource Include="https://my-nuget-source/nuget/" />
+        -->
+    </ItemGroup>
+
+    <PropertyGroup Condition=" '$(OS)' == 'Windows_NT'">
+        <!-- Windows specific commands -->
+        <NuGetToolsPath>$([System.IO.Path]::Combine($(SolutionDir), ".nuget"))</NuGetToolsPath>
+    </PropertyGroup>
+
+    <PropertyGroup Condition=" '$(OS)' != 'Windows_NT'">
+        <!-- We need to launch nuget.exe with the mono command if we're not on windows -->
+        <NuGetToolsPath>$(SolutionDir).nuget</NuGetToolsPath>
+    </PropertyGroup>
+
+    <PropertyGroup>
+        <PackagesProjectConfig Condition=" '$(OS)' == 'Windows_NT'">$(MSBuildProjectDirectory)\packages.$(MSBuildProjectName.Replace(' ', '_')).config</PackagesProjectConfig>
+        <PackagesProjectConfig Condition=" '$(OS)' != 'Windows_NT'">$(MSBuildProjectDirectory)\packages.$(MSBuildProjectName).config</PackagesProjectConfig>
+    </PropertyGroup>
+
+    <PropertyGroup>
+      <PackagesConfig Condition="Exists('$(MSBuildProjectDirectory)\packages.config')">$(MSBuildProjectDirectory)\packages.config</PackagesConfig>
+      <PackagesConfig Condition="Exists('$(PackagesProjectConfig)')">$(PackagesProjectConfig)</PackagesConfig>
+    </PropertyGroup>
+    
+    <PropertyGroup>
+        <!-- NuGet command -->
+        <NuGetExePath Condition=" '$(NuGetExePath)' == '' ">$(NuGetToolsPath)\NuGet.exe</NuGetExePath>
+        <PackageSources Condition=" $(PackageSources) == '' ">@(PackageSource)</PackageSources>
+
+        <NuGetCommand Condition=" '$(OS)' == 'Windows_NT'">"$(NuGetExePath)"</NuGetCommand>
+        <NuGetCommand Condition=" '$(OS)' != 'Windows_NT' ">mono --runtime=v4.0.30319 "$(NuGetExePath)"</NuGetCommand>
+
+        <PackageOutputDir Condition="$(PackageOutputDir) == ''">$(TargetDir.Trim('\\'))</PackageOutputDir>
+
+        <RequireConsentSwitch Condition=" $(RequireRestoreConsent) == 'true' ">-RequireConsent</RequireConsentSwitch>
+        <NonInteractiveSwitch Condition=" '$(VisualStudioVersion)' != '' AND '$(OS)' == 'Windows_NT' ">-NonInteractive</NonInteractiveSwitch>
+
+        <PaddedSolutionDir Condition=" '$(OS)' == 'Windows_NT'">"$(SolutionDir) "</PaddedSolutionDir>
+        <PaddedSolutionDir Condition=" '$(OS)' != 'Windows_NT' ">"$(SolutionDir)"</PaddedSolutionDir>
+
+        <!-- Commands -->
+        <RestoreCommand>$(NuGetCommand) install "$(PackagesConfig)" -source "$(PackageSources)"  $(NonInteractiveSwitch) $(RequireConsentSwitch) -solutionDir $(PaddedSolutionDir)</RestoreCommand>
+        <BuildCommand>$(NuGetCommand) pack "$(ProjectPath)" -Properties "Configuration=$(Configuration);Platform=$(Platform)" $(NonInteractiveSwitch) -OutputDirectory "$(PackageOutputDir)" -symbols</BuildCommand>
+
+        <!-- We need to ensure packages are restored prior to assembly resolve -->
+        <BuildDependsOn Condition="$(RestorePackages) == 'true'">
+            RestorePackages;
+            $(BuildDependsOn);
+        </BuildDependsOn>
+
+        <!-- Make the build depend on restore packages -->
+        <BuildDependsOn Condition="$(BuildPackage) == 'true'">
+            $(BuildDependsOn);
+            BuildPackage;
+        </BuildDependsOn>
+    </PropertyGroup>
+
+    <Target Name="CheckPrerequisites">
+        <!-- Raise an error if we're unable to locate nuget.exe  -->
+        <Error Condition="'$(DownloadNuGetExe)' != 'true' AND !Exists('$(NuGetExePath)')" Text="Unable to locate '$(NuGetExePath)'" />
+        <!--
+        Take advantage of MsBuild's build dependency tracking to make sure that we only ever download nuget.exe once.
+        This effectively acts as a lock that makes sure that the download operation will only happen once and all
+        parallel builds will have to wait for it to complete.
+        -->
+        <MsBuild Targets="_DownloadNuGet" Projects="$(MSBuildThisFileFullPath)" Properties="Configuration=NOT_IMPORTANT;DownloadNuGetExe=$(DownloadNuGetExe)" />
+    </Target>
+
+    <Target Name="_DownloadNuGet">
+        <DownloadNuGet OutputFilename="$(NuGetExePath)" Condition=" '$(DownloadNuGetExe)' == 'true' AND !Exists('$(NuGetExePath)')" />
+    </Target>
+
+    <Target Name="RestorePackages" DependsOnTargets="CheckPrerequisites">        
+        <Exec Command="$(RestoreCommand)"
+              Condition="'$(OS)' != 'Windows_NT' And Exists('$(PackagesConfig)')" />
+
+        <Exec Command="$(RestoreCommand)"
+              LogStandardErrorAsError="true"
+              Condition="'$(OS)' == 'Windows_NT' And Exists('$(PackagesConfig)')" />
+    </Target>
+
+    <Target Name="BuildPackage" DependsOnTargets="CheckPrerequisites">
+        <Exec Command="$(BuildCommand)"
+              Condition=" '$(OS)' != 'Windows_NT' " />
+
+        <Exec Command="$(BuildCommand)"
+              LogStandardErrorAsError="true"
+              Condition=" '$(OS)' == 'Windows_NT' " />
+    </Target>
+
+    <UsingTask TaskName="DownloadNuGet" TaskFactory="CodeTaskFactory" AssemblyFile="$(MSBuildToolsPath)\Microsoft.Build.Tasks.v4.0.dll">
+        <ParameterGroup>
+            <OutputFilename ParameterType="System.String" Required="true" />
+        </ParameterGroup>
+        <Task>
+            <Reference Include="System.Core" />
+            <Using Namespace="System" />
+            <Using Namespace="System.IO" />
+            <Using Namespace="System.Net" />
+            <Using Namespace="Microsoft.Build.Framework" />
+            <Using Namespace="Microsoft.Build.Utilities" />
+            <Code Type="Fragment" Language="cs">
+                <![CDATA[
+                try {
+                    OutputFilename = Path.GetFullPath(OutputFilename);
+
+                    Log.LogMessage("Downloading latest version of NuGet.exe...");
+                    WebClient webClient = new WebClient();
+                    webClient.DownloadFile("https://www.nuget.org/nuget.exe", OutputFilename);
+
+                    return true;
+                }
+                catch (Exception ex) {
+                    Log.LogErrorFromException(ex);
+                    return false;
+                }
+            ]]>
+            </Code>
+        </Task>
+    </UsingTask>
+</Project>
diff --git a/AspNetIdentity2GroupPermissions.sln b/AspNetIdentity2GroupPermissions.sln
index 177bbe2..a0f9cbc 100644
--- a/AspNetIdentity2GroupPermissions.sln
+++ b/AspNetIdentity2GroupPermissions.sln
@@ -1,10 +1,17 @@
 
 Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio 2013
-VisualStudioVersion = 12.0.30110.0
+VisualStudioVersion = 12.0.30501.0
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AspNetIdentity2GroupPermissions", "AspNetIdentity2GroupPermissions\AspNetIdentity2GroupPermissions.csproj", "{90053234-F75B-4623-8D24-DCBE76917590}"
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = ".nuget", ".nuget", "{6308811E-6F69-4BB7-9DF5-7764D87C2A11}"
+	ProjectSection(SolutionItems) = preProject
+		.nuget\NuGet.Config = .nuget\NuGet.Config
+		.nuget\NuGet.exe = .nuget\NuGet.exe
+		.nuget\NuGet.targets = .nuget\NuGet.targets
+	EndProjectSection
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
diff --git a/AspNetIdentity2GroupPermissions/App_Start/BundleConfig.cs b/AspNetIdentity2GroupPermissions/App_Start/BundleConfig.cs
index 5a52701..aec6ce3 100644
--- a/AspNetIdentity2GroupPermissions/App_Start/BundleConfig.cs
+++ b/AspNetIdentity2GroupPermissions/App_Start/BundleConfig.cs
@@ -24,7 +24,8 @@ public static void RegisterBundles(BundleCollection bundles)
 
             bundles.Add(new StyleBundle("~/Content/css").Include(
                       "~/Content/bootstrap.css",
-                      "~/Content/site.css"));
+                      "~/Content/site.css",
+                       "~/Content/loader.css"));
         }
     }
-}
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/AspNetIdentity2GroupPermissions.csproj b/AspNetIdentity2GroupPermissions/AspNetIdentity2GroupPermissions.csproj
index c365a67..b29b3f2 100644
--- a/AspNetIdentity2GroupPermissions/AspNetIdentity2GroupPermissions.csproj
+++ b/AspNetIdentity2GroupPermissions/AspNetIdentity2GroupPermissions.csproj
@@ -20,6 +20,8 @@
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
     <WebGreaseLibPath>..\packages\WebGrease.1.5.2\lib</WebGreaseLibPath>
+    <SolutionDir Condition="$(SolutionDir) == '' Or $(SolutionDir) == '*Undefined*'">..\</SolutionDir>
+    <RestorePackages>true</RestorePackages>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -154,6 +156,14 @@
     <Content Include="Views\GroupsAdmin\Details.cshtml" />
     <Content Include="Views\GroupsAdmin\Edit.cshtml" />
     <Content Include="Views\GroupsAdmin\Index.cshtml" />
+    <Content Include="Views\ActionPermission\Index.cshtml" />
+    <Content Include="Views\ActionPermission\Create.cshtml" />
+    <Content Include="Views\ActionPermission\Details.cshtml" />
+    <Content Include="Views\ActionPermission\Permissions.cshtml" />
+    <Content Include="Views\ActionPermission\Edit.cshtml" />
+    <Content Include="Views\Secure\Index.cshtml" />
+    <Content Include="Views\Secure\Details.cshtml" />
+    <Content Include="Views\Secure\Create.cshtml" />
     <None Include="Web.Debug.config">
       <DependentUpon>Web.config</DependentUpon>
     </None>
@@ -232,24 +242,33 @@
     <Compile Include="App_Start\RouteConfig.cs" />
     <Compile Include="App_Start\Startup.Auth.cs" />
     <Compile Include="Controllers\AccountController.cs" />
+    <Compile Include="Controllers\ActionPermissionController.cs" />
     <Compile Include="Controllers\GroupsAdminController.cs" />
     <Compile Include="Controllers\HomeController.cs" />
     <Compile Include="Controllers\ManageController.cs" />
     <Compile Include="Controllers\RolesAdminController.cs" />
+    <Compile Include="Controllers\SecureController.cs" />
     <Compile Include="Controllers\UserAdminController.cs" />
     <Compile Include="Global.asax.cs">
       <DependentUpon>Global.asax</DependentUpon>
     </Compile>
+    <Compile Include="Migrations\Configuration.cs" />
     <Compile Include="Models\AccountViewModels.cs" />
+    <Compile Include="Models\ActionPermissionManager.cs" />
     <Compile Include="Models\AdminViewModel.cs" />
+    <Compile Include="Models\ApplicationActionPermission.cs" />
+    <Compile Include="Models\ApplicationActionPermissionRole.cs" />
     <Compile Include="Models\ApplicationGroupManager.cs" />
     <Compile Include="Models\ApplicationGroupStore.cs" />
     <Compile Include="Models\GroupStoreBase.cs" />
     <Compile Include="Models\IdentityModels.cs" />
     <Compile Include="Models\ManageViewModels.cs" />
+    <Compile Include="Models\ActionPermissionsStoreBase.cs" />
+    <Compile Include="Models\PermissionFilter.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
     <Compile Include="Startup.cs" />
   </ItemGroup>
+  <ItemGroup />
   <PropertyGroup>
     <VisualStudioVersion Condition="'$(VisualStudioVersion)' == ''">10.0</VisualStudioVersion>
     <VSToolsPath Condition="'$(VSToolsPath)' == ''">$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VisualStudioVersion)</VSToolsPath>
@@ -275,6 +294,13 @@
       </FlavorProperties>
     </VisualStudio>
   </ProjectExtensions>
+  <Import Project="$(SolutionDir)\.nuget\NuGet.targets" Condition="Exists('$(SolutionDir)\.nuget\NuGet.targets')" />
+  <Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
+    <PropertyGroup>
+      <ErrorText>This project references NuGet package(s) that are missing on this computer. Enable NuGet Package Restore to download them.  For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
+    </PropertyGroup>
+    <Error Condition="!Exists('$(SolutionDir)\.nuget\NuGet.targets')" Text="$([System.String]::Format('$(ErrorText)', '$(SolutionDir)\.nuget\NuGet.targets'))" />
+  </Target>
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
   <Target Name="BeforeBuild">
diff --git a/AspNetIdentity2GroupPermissions/Controllers/AccountController.cs b/AspNetIdentity2GroupPermissions/Controllers/AccountController.cs
index 0a3fd67..d16b2a5 100644
--- a/AspNetIdentity2GroupPermissions/Controllers/AccountController.cs
+++ b/AspNetIdentity2GroupPermissions/Controllers/AccountController.cs
@@ -1,13 +1,16 @@
-using System.Globalization;
-using IdentitySample.Models;
+using IdentitySample.Models;
 using Microsoft.AspNet.Identity;
 using Microsoft.AspNet.Identity.Owin;
 using Microsoft.Owin.Security;
 using System;
+using System.Collections.Generic;
+using System.Globalization;
 using System.Linq;
 using System.Security.Claims;
+using System.Threading;
 using System.Threading.Tasks;
 using System.Web;
+using System.Web.Helpers;
 using System.Web.Mvc;
 
 namespace IdentitySample.Controllers
@@ -15,40 +18,46 @@ namespace IdentitySample.Controllers
     [Authorize]
     public class AccountController : Controller
     {
+        private ApplicationGroupManager _groupManager;
+        private ActionPermissionManager _permissionManager = new ActionPermissionManager();
+        private ApplicationRoleManager _roleManager;
+        private ApplicationSignInManager _signInManager;
+
+        private ApplicationUserManager _userManager;
+
         public AccountController()
         {
         }
 
-        public AccountController(ApplicationUserManager userManager, ApplicationSignInManager signInManager )
+        public AccountController(ApplicationUserManager userManager, ApplicationSignInManager signInManager, ApplicationGroupManager groupManager, ApplicationRoleManager roleManager)
         {
             UserManager = userManager;
             SignInManager = signInManager;
+            GroupManager = groupManager;
+            RoleManager = roleManager;
         }
 
-        private ApplicationUserManager _userManager;
-        public ApplicationUserManager UserManager
+        public ApplicationGroupManager GroupManager
         {
             get
             {
-                return _userManager ?? HttpContext.GetOwinContext().GetUserManager<ApplicationUserManager>();
-            }
-            private set
-            {
-                _userManager = value;
+                return _groupManager ?? HttpContext.GetOwinContext().Get<ApplicationGroupManager>();
             }
+            private set { _groupManager = value; }
         }
 
-        //
-        // GET: /Account/Login
-        [AllowAnonymous]
-        public ActionResult Login(string returnUrl)
+        public ApplicationRoleManager RoleManager
         {
-            ViewBag.ReturnUrl = returnUrl;
-            return View();
+            get
+            {
+                return _roleManager ?? HttpContext.GetOwinContext().Get<ApplicationRoleManager>();
+            }
+            private set
+            {
+                _roleManager = value;
+            }
         }
 
-        private ApplicationSignInManager _signInManager;
-
         public ApplicationSignInManager SignInManager
         {
             get
@@ -58,125 +67,119 @@ public ApplicationSignInManager SignInManager
             private set { _signInManager = value; }
         }
 
-        //
-        // POST: /Account/Login
-        [HttpPost]
-        [AllowAnonymous]
-        [ValidateAntiForgeryToken]
-        public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
+        public ApplicationUserManager UserManager
         {
-            if (!ModelState.IsValid)
+            get
             {
-                return View(model);
+                return _userManager ?? HttpContext.GetOwinContext().GetUserManager<ApplicationUserManager>();
             }
-
-            // This doen't count login failures towards lockout only two factor authentication
-            // To enable password failures to trigger lockout, change to shouldLockout: true
-            var result = await SignInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, shouldLockout: false);
-            switch (result)
+            private set
             {
-                case SignInStatus.Success:
-                    return RedirectToLocal(returnUrl);
-                case SignInStatus.LockedOut:
-                    return View("Lockout");
-                case SignInStatus.RequiresVerification:
-                    return RedirectToAction("SendCode", new { ReturnUrl = returnUrl });
-                case SignInStatus.Failure:
-                default:
-                    ModelState.AddModelError("", "Invalid login attempt.");
-                    return View(model);
+                _userManager = value;
             }
         }
 
         //
-        // GET: /Account/VerifyCode
+        // GET: /Account/ConfirmEmail
         [AllowAnonymous]
-        public async Task<ActionResult> VerifyCode(string provider, string returnUrl)
+        public async Task<ActionResult> ConfirmEmail(string userId, string code)
         {
-            // Require that the user has already logged in via username/password or external login
-            if (!await SignInManager.HasBeenVerifiedAsync())
+            if (userId == null || code == null)
             {
                 return View("Error");
             }
-            var user = await UserManager.FindByIdAsync(await SignInManager.GetVerifiedUserIdAsync());
-            if (user != null)
-            {
-                ViewBag.Status = "For DEMO purposes the current " + provider + " code is: " + await UserManager.GenerateTwoFactorTokenAsync(user.Id, provider);
-            }
-            return View(new VerifyCodeViewModel { Provider = provider, ReturnUrl = returnUrl });
+            var result = await UserManager.ConfirmEmailAsync(userId, code);
+            return View(result.Succeeded ? "ConfirmEmail" : "Error");
         }
 
         //
-        // POST: /Account/VerifyCode
+        // POST: /Account/ExternalLogin
         [HttpPost]
         [AllowAnonymous]
         [ValidateAntiForgeryToken]
-        public async Task<ActionResult> VerifyCode(VerifyCodeViewModel model)
+        public ActionResult ExternalLogin(string provider, string returnUrl)
         {
-            if (!ModelState.IsValid)
+            // Request a redirect to the external login provider
+            return new ChallengeResult(provider, Url.Action("ExternalLoginCallback", "Account", new { ReturnUrl = returnUrl }));
+        }
+
+        //
+        // GET: /Account/ExternalLoginCallback
+        [AllowAnonymous]
+        public async Task<ActionResult> ExternalLoginCallback(string returnUrl)
+        {
+            var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync();
+            if (loginInfo == null)
             {
-                return View(model);
+                return RedirectToAction("Login");
             }
 
-            var result = await SignInManager.TwoFactorSignInAsync(model.Provider, model.Code, isPersistent: false, rememberBrowser: model.RememberBrowser);
+            // Sign in the user with this external login provider if the user already has a login
+            var result = await SignInManager.ExternalSignInAsync(loginInfo, isPersistent: false);
             switch (result)
             {
                 case SignInStatus.Success:
-                    return RedirectToLocal(model.ReturnUrl);
+                    return RedirectToLocal(returnUrl);
+
                 case SignInStatus.LockedOut:
                     return View("Lockout");
+
+                case SignInStatus.RequiresVerification:
+                    return RedirectToAction("SendCode", new { ReturnUrl = returnUrl });
+
                 case SignInStatus.Failure:
                 default:
-                    ModelState.AddModelError("", "Invalid code.");
-                    return View(model);
+                    // If the user does not have an account, then prompt the user to create an account
+                    ViewBag.ReturnUrl = returnUrl;
+                    ViewBag.LoginProvider = loginInfo.Login.LoginProvider;
+                    return View("ExternalLoginConfirmation", new ExternalLoginConfirmationViewModel { Email = loginInfo.Email });
             }
         }
 
         //
-        // GET: /Account/Register
-        [AllowAnonymous]
-        public ActionResult Register()
-        {
-            return View();
-        }
-
-        //
-        // POST: /Account/Register
+        // POST: /Account/ExternalLoginConfirmation
         [HttpPost]
         [AllowAnonymous]
         [ValidateAntiForgeryToken]
-        public async Task<ActionResult> Register(RegisterViewModel model)
+        public async Task<ActionResult> ExternalLoginConfirmation(ExternalLoginConfirmationViewModel model, string returnUrl)
         {
+            if (User.Identity.IsAuthenticated)
+            {
+                return RedirectToAction("Index", "Manage");
+            }
+
             if (ModelState.IsValid)
             {
+                // Get the information about the user from the external login provider
+                var info = await AuthenticationManager.GetExternalLoginInfoAsync();
+                if (info == null)
+                {
+                    return View("ExternalLoginFailure");
+                }
                 var user = new ApplicationUser { UserName = model.Email, Email = model.Email };
-                var result = await UserManager.CreateAsync(user, model.Password);
+                var result = await UserManager.CreateAsync(user);
                 if (result.Succeeded)
                 {
-                    var code = await UserManager.GenerateEmailConfirmationTokenAsync(user.Id);
-                    var callbackUrl = Url.Action("ConfirmEmail", "Account", new { userId = user.Id, code = code }, protocol: Request.Url.Scheme);
-                    await UserManager.SendEmailAsync(user.Id, "Confirm your account", "Please confirm your account by clicking this link: <a href=\"" + callbackUrl + "\">link</a>");
-                    ViewBag.Link = callbackUrl;
-                    return View("DisplayEmail");
+                    result = await UserManager.AddLoginAsync(user.Id, info.Login);
+                    if (result.Succeeded)
+                    {
+                        await SignInManager.SignInAsync(user, isPersistent: false, rememberBrowser: false);
+                        return RedirectToLocal(returnUrl);
+                    }
                 }
                 AddErrors(result);
             }
 
-            // If we got this far, something failed, redisplay form
+            ViewBag.ReturnUrl = returnUrl;
             return View(model);
         }
 
         //
-        // GET: /Account/ConfirmEmail
+        // GET: /Account/ExternalLoginFailure
         [AllowAnonymous]
-        public async Task<ActionResult> ConfirmEmail(string userId, string code)
+        public ActionResult ExternalLoginFailure()
         {
-            if (userId == null || code == null)
-            {
-                return View("Error");
-            }
-            var result = await UserManager.ConfirmEmailAsync(userId, code);
-            return View(result.Succeeded ? "ConfirmEmail" : "Error");
+            return View();
         }
 
         //
@@ -222,6 +225,92 @@ public ActionResult ForgotPasswordConfirmation()
             return View();
         }
 
+        //
+        // GET: /Account/Login
+        [AllowAnonymous]
+        public ActionResult Login(string returnUrl)
+        {
+            ViewBag.ReturnUrl = returnUrl;
+            return View();
+        }
+
+        //
+        // POST: /Account/Login
+        [HttpPost]
+        [AllowAnonymous]
+        [ValidateAntiForgeryToken]
+        public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
+        {
+            if (!ModelState.IsValid)
+            {
+                return View(model);
+            }
+
+            // This doen't count login failures towards lockout only two factor authentication
+            // To enable password failures to trigger lockout, change to shouldLockout: true
+            var result = await SignInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, shouldLockout: false);
+            switch (result)
+            {
+                case SignInStatus.Success:
+                    return RedirectToLocal(returnUrl);
+
+                case SignInStatus.LockedOut:
+                    return View("Lockout");
+
+                case SignInStatus.RequiresVerification:
+                    return RedirectToAction("SendCode", new { ReturnUrl = returnUrl });
+
+                case SignInStatus.Failure:
+                default:
+                    ModelState.AddModelError("", "Invalid login attempt.");
+                    return View(model);
+            }
+        }
+
+        //
+        // POST: /Account/LogOff
+        [HttpPost]
+        [ValidateAntiForgeryToken]
+        public ActionResult LogOff()
+        {
+            AuthenticationManager.SignOut();
+            return RedirectToAction("Index", "Home");
+        }
+
+        //
+        // GET: /Account/Register
+        [AllowAnonymous]
+        public ActionResult Register()
+        {
+            return View();
+        }
+
+        //
+        // POST: /Account/Register
+        [HttpPost]
+        [AllowAnonymous]
+        [ValidateAntiForgeryToken]
+        public async Task<ActionResult> Register(RegisterViewModel model)
+        {
+            if (ModelState.IsValid)
+            {
+                var user = new ApplicationUser { UserName = model.Email, Email = model.Email };
+                var result = await UserManager.CreateAsync(user, model.Password);
+                if (result.Succeeded)
+                {
+                    var code = await UserManager.GenerateEmailConfirmationTokenAsync(user.Id);
+                    var callbackUrl = Url.Action("ConfirmEmail", "Account", new { userId = user.Id, code = code }, protocol: Request.Url.Scheme);
+                    await UserManager.SendEmailAsync(user.Id, "Confirm your account", "Please confirm your account by clicking this link: <a href=\"" + callbackUrl + "\">link</a>");
+                    ViewBag.Link = callbackUrl;
+                    return View("DisplayEmail");
+                }
+                AddErrors(result);
+            }
+
+            // If we got this far, something failed, redisplay form
+            return View(model);
+        }
+
         //
         // GET: /Account/ResetPassword
         [AllowAnonymous]
@@ -264,17 +353,6 @@ public ActionResult ResetPasswordConfirmation()
             return View();
         }
 
-        //
-        // POST: /Account/ExternalLogin
-        [HttpPost]
-        [AllowAnonymous]
-        [ValidateAntiForgeryToken]
-        public ActionResult ExternalLogin(string provider, string returnUrl)
-        {
-            // Request a redirect to the external login provider
-            return new ChallengeResult(provider, Url.Action("ExternalLoginCallback", "Account", new { ReturnUrl = returnUrl }));
-        }
-
         //
         // GET: /Account/SendCode
         [AllowAnonymous]
@@ -311,92 +389,53 @@ public async Task<ActionResult> SendCode(SendCodeViewModel model)
         }
 
         //
-        // GET: /Account/ExternalLoginCallback
+        // GET: /Account/VerifyCode
         [AllowAnonymous]
-        public async Task<ActionResult> ExternalLoginCallback(string returnUrl)
+        public async Task<ActionResult> VerifyCode(string provider, string returnUrl)
         {
-            var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync();
-            if (loginInfo == null)
+            // Require that the user has already logged in via username/password or external login
+            if (!await SignInManager.HasBeenVerifiedAsync())
             {
-                return RedirectToAction("Login");
+                return View("Error");
             }
-
-            // Sign in the user with this external login provider if the user already has a login
-            var result = await SignInManager.ExternalSignInAsync(loginInfo, isPersistent: false);
-            switch (result)
+            var user = await UserManager.FindByIdAsync(await SignInManager.GetVerifiedUserIdAsync());
+            if (user != null)
             {
-                case SignInStatus.Success:
-                    return RedirectToLocal(returnUrl);
-                case SignInStatus.LockedOut:
-                    return View("Lockout");
-                case SignInStatus.RequiresVerification:
-                    return RedirectToAction("SendCode", new { ReturnUrl = returnUrl });
-                case SignInStatus.Failure:
-                default:
-                    // If the user does not have an account, then prompt the user to create an account
-                    ViewBag.ReturnUrl = returnUrl;
-                    ViewBag.LoginProvider = loginInfo.Login.LoginProvider;
-                    return View("ExternalLoginConfirmation", new ExternalLoginConfirmationViewModel { Email = loginInfo.Email });
+                ViewBag.Status = "For DEMO purposes the current " + provider + " code is: " + await UserManager.GenerateTwoFactorTokenAsync(user.Id, provider);
             }
+            return View(new VerifyCodeViewModel { Provider = provider, ReturnUrl = returnUrl });
         }
 
         //
-        // POST: /Account/ExternalLoginConfirmation
+        // POST: /Account/VerifyCode
         [HttpPost]
         [AllowAnonymous]
         [ValidateAntiForgeryToken]
-        public async Task<ActionResult> ExternalLoginConfirmation(ExternalLoginConfirmationViewModel model, string returnUrl)
+        public async Task<ActionResult> VerifyCode(VerifyCodeViewModel model)
         {
-            if (User.Identity.IsAuthenticated)
+            if (!ModelState.IsValid)
             {
-                return RedirectToAction("Index", "Manage");
+                return View(model);
             }
 
-            if (ModelState.IsValid)
+            var result = await SignInManager.TwoFactorSignInAsync(model.Provider, model.Code, isPersistent: false, rememberBrowser: model.RememberBrowser);
+            switch (result)
             {
-                // Get the information about the user from the external login provider
-                var info = await AuthenticationManager.GetExternalLoginInfoAsync();
-                if (info == null)
-                {
-                    return View("ExternalLoginFailure");
-                }
-                var user = new ApplicationUser { UserName = model.Email, Email = model.Email };
-                var result = await UserManager.CreateAsync(user);
-                if (result.Succeeded)
-                {
-                    result = await UserManager.AddLoginAsync(user.Id, info.Login);
-                    if (result.Succeeded)
-                    {
-                        await SignInManager.SignInAsync(user, isPersistent: false, rememberBrowser: false);
-                        return RedirectToLocal(returnUrl);
-                    }
-                }
-                AddErrors(result);
-            }
-
-            ViewBag.ReturnUrl = returnUrl;
-            return View(model);
-        }
+                case SignInStatus.Success:
+                    return RedirectToLocal(model.ReturnUrl);
 
-        //
-        // POST: /Account/LogOff
-        [HttpPost]
-        [ValidateAntiForgeryToken]
-        public ActionResult LogOff()
-        {
-            AuthenticationManager.SignOut();
-            return RedirectToAction("Index", "Home");
-        }
+                case SignInStatus.LockedOut:
+                    return View("Lockout");
 
-        //
-        // GET: /Account/ExternalLoginFailure
-        [AllowAnonymous]
-        public ActionResult ExternalLoginFailure()
-        {
-            return View();
+                case SignInStatus.Failure:
+                default:
+                    ModelState.AddModelError("", "Invalid code.");
+                    return View(model);
+            }
         }
 
         #region Helpers
+
         // Used for XSRF protection when adding external logins
         private const string XsrfKey = "XsrfId";
 
@@ -440,7 +479,9 @@ public ChallengeResult(string provider, string redirectUri, string userId)
             }
 
             public string LoginProvider { get; set; }
+
             public string RedirectUri { get; set; }
+
             public string UserId { get; set; }
 
             public override void ExecuteResult(ControllerContext context)
@@ -453,6 +494,7 @@ public override void ExecuteResult(ControllerContext context)
                 context.HttpContext.GetOwinContext().Authentication.Challenge(properties, LoginProvider);
             }
         }
-        #endregion
+
+        #endregion Helpers
     }
 }
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Controllers/ActionPermissionController.cs b/AspNetIdentity2GroupPermissions/Controllers/ActionPermissionController.cs
new file mode 100644
index 0000000..6e0ab94
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Controllers/ActionPermissionController.cs
@@ -0,0 +1,182 @@
+using IdentitySample.Models;
+using Microsoft.AspNet.Identity.Owin;
+using System.Linq;
+using System.Net;
+using System.Threading.Tasks;
+using System.Web;
+using System.Web.Mvc;
+
+namespace IdentitySample.Controllers
+{
+    public class ActionPermissionController : Controller
+    {
+        private ActionPermissionManager _actionPermissionManager;
+        private ApplicationRoleManager _roleManager;
+
+        public ActionPermissionManager ActionPermissionManager
+        {
+            get
+            {
+                return _actionPermissionManager ?? new ActionPermissionManager();
+            }
+            private set
+            {
+                _actionPermissionManager = value;
+            }
+        }
+
+        public ApplicationRoleManager RoleManager
+        {
+            get
+            {
+                return _roleManager ?? HttpContext.GetOwinContext()
+                    .Get<ApplicationRoleManager>();
+            }
+            private set
+            {
+                _roleManager = value;
+            }
+        }
+
+        public ActionResult Create()
+        {
+            ViewBag.RolesList = new SelectList(
+                  this.RoleManager.Roles.ToList(), "Id", "Name");
+            return View();
+        }
+
+        [HttpPost]
+        [ValidateAntiForgeryToken]
+        public async Task<ActionResult> Create([Bind(Include = "ControllerName,ActionName")] ApplicationActionPermission applicationpermission, params string[] selectedRoles)
+        {
+            if (ModelState.IsValid)
+            {
+                selectedRoles = selectedRoles ?? new string[] { };
+                var result = await ActionPermissionManager.CreateActionPermissionAsync(applicationpermission);
+                if (result)
+                    await ActionPermissionManager.AddPermissionRolesAsync(applicationpermission.Id, selectedRoles);
+                return RedirectToAction("Index");
+            }
+            ViewBag.RolesList = new SelectList(
+                  this.RoleManager.Roles.ToList(), "Id", "Name");
+            return View(applicationpermission);
+        }
+
+        [PermissionFilter]
+        public async Task<ActionResult> Delete(int id)
+        {
+            if (id <= 0)
+            {
+                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+            }
+
+            var result = await this.ActionPermissionManager.DeleteAsync(id);
+            return RedirectToAction("Index");
+        }
+
+        public async Task<ActionResult> Details(string controllerName)
+        {
+            if (string.IsNullOrEmpty(controllerName))
+            {
+                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+            }
+            var applicationpermissions =
+                 this.ActionPermissionManager.ActionPermissions.Where(x => x.ControllerName == controllerName).ToList();
+            if (!applicationpermissions.Any())
+            {
+                return HttpNotFound();
+            }
+
+            return View(applicationpermissions);
+        }
+
+        public async Task<ActionResult> Edit(int id)
+        {
+            if (id <= 0)
+            {
+                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+            }
+            var applicationpermissions =
+                await this.ActionPermissionManager.GetByIdAsync(id);
+            if (applicationpermissions == null)
+            {
+                return HttpNotFound();
+            }
+            var actionRoles = this.ActionPermissionManager.GetControllerActionRoles(id).ToList();
+            // Get a list, not a DbSet or queryable:
+            var allRoles = this.RoleManager.Roles.ToList();
+
+            var model = new PermissionViewModel()
+            {
+                Id = applicationpermissions.Id,
+                ControllerName = applicationpermissions.ControllerName,
+                ActionName = applicationpermissions.ActionName
+            };
+
+            // load the roles/Roles for selection in the form:
+            foreach (var role in allRoles)
+            {
+                var listItem = new SelectListItem()
+                {
+                    Text = role.Name,
+                    Value = role.Id,
+                    Selected = actionRoles.Any(g => g.Id == role.Id)
+                };
+                model.RolesList.Add(listItem);
+            }
+            return View(model);
+        }
+
+        [HttpPost]
+        [ValidateAntiForgeryToken]
+        public async Task<ActionResult> Edit(
+            [Bind(Include = "Id,ControllerName,ActionName")] PermissionViewModel model, params string[] selectedRoles)
+        {
+            var permission = await this.ActionPermissionManager.GetByIdAsync(model.Id);
+            if (permission == null)
+            {
+                return HttpNotFound();
+            }
+            if (ModelState.IsValid)
+            {
+                permission.ActionName = model.ActionName;
+                permission.ControllerName = model.ControllerName;
+                await this.ActionPermissionManager.UpdateActionPermissionAsync(permission);
+
+                selectedRoles = selectedRoles ?? new string[] { };
+                await this.ActionPermissionManager.AddPermissionRolesAsync(permission.Id, selectedRoles);
+                return RedirectToAction("Permissions", new { id = permission.Id });
+            }
+            return View(model);
+        }
+
+        // GET: ActionPermission
+
+        public ActionResult Index()
+        {
+            var model =
+                ActionPermissionManager.ActionPermissions.GroupBy(a => a.ControllerName).Select(g => new ActionViewModel { Actions = g.Count(), Controller = g.Key }).ToList();
+
+            return View(model);
+        }
+
+        public async Task<ActionResult> Permissions(int id)
+        {
+            if (id <= 0)
+            {
+                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+            }
+            var applicationpermission =
+                await this.ActionPermissionManager.GetByIdAsync(id);
+            if (applicationpermission == null)
+            {
+                return HttpNotFound();
+            }
+            var actionRoles = this.ActionPermissionManager.GetControllerActionRoles(id);
+            string[] roleNames = actionRoles.Select(p => p.Name).ToArray();
+            ViewBag.RolesList = roleNames;
+
+            return View(applicationpermission);
+        }
+    }
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Controllers/GroupsAdminController.cs b/AspNetIdentity2GroupPermissions/Controllers/GroupsAdminController.cs
index 7a50f0e..7656868 100644
--- a/AspNetIdentity2GroupPermissions/Controllers/GroupsAdminController.cs
+++ b/AspNetIdentity2GroupPermissions/Controllers/GroupsAdminController.cs
@@ -15,6 +15,7 @@ public class GroupsAdminController : Controller
         private ApplicationDbContext db = new ApplicationDbContext();
 
         private ApplicationGroupManager _groupManager;
+
         public ApplicationGroupManager GroupManager
         {
             get
@@ -28,6 +29,7 @@ private set
         }
 
         private ApplicationRoleManager _roleManager;
+
         public ApplicationRoleManager RoleManager
         {
             get
@@ -41,13 +43,12 @@ private set
             }
         }
 
-
+        [PermissionFilter]
         public ActionResult Index()
         {
             return View(this.GroupManager.Groups.ToList());
         }
 
-
         public async Task<ActionResult> Details(string id)
         {
             if (id == null)
@@ -67,7 +68,6 @@ public async Task<ActionResult> Details(string id)
             return View(applicationgroup);
         }
 
-
         public ActionResult Create()
         {
             //Get a SelectList of Roles to choose from in the View:
@@ -76,7 +76,6 @@ public ActionResult Create()
             return View();
         }
 
-
         [HttpPost]
         [ValidateAntiForgeryToken]
         public async Task<ActionResult> Create(
@@ -102,7 +101,6 @@ public async Task<ActionResult> Create(
             return View(applicationgroup);
         }
 
-
         public async Task<ActionResult> Edit(string id)
         {
             if (id == null)
@@ -123,7 +121,8 @@ public async Task<ActionResult> Edit(string id)
             {
                 Id = applicationgroup.Id,
                 Name = applicationgroup.Name,
-                Description = applicationgroup.Description
+                Description = applicationgroup.Description,
+                IsAdmin = applicationgroup.IsAdmin
             };
 
             // load the roles/Roles for selection in the form:
@@ -140,11 +139,10 @@ public async Task<ActionResult> Edit(string id)
             return View(model);
         }
 
-
         [HttpPost]
         [ValidateAntiForgeryToken]
         public async Task<ActionResult> Edit(
-            [Bind(Include = "Id,Name,Description")] GroupViewModel model, params string[] selectedRoles)
+            [Bind(Include = "Id,Name,Description,IsAdmin")] GroupViewModel model, params string[] selectedRoles)
         {
             var group = await this.GroupManager.FindByIdAsync(model.Id);
             if (group == null)
@@ -164,7 +162,6 @@ public async Task<ActionResult> Edit(
             return View(model);
         }
 
-
         public async Task<ActionResult> Delete(string id)
         {
             if (id == null)
@@ -179,7 +176,6 @@ public async Task<ActionResult> Delete(string id)
             return View(applicationgroup);
         }
 
-
         [HttpPost, ActionName("Delete")]
         [ValidateAntiForgeryToken]
         public async Task<ActionResult> DeleteConfirmed(string id)
@@ -193,7 +189,6 @@ public async Task<ActionResult> DeleteConfirmed(string id)
             return RedirectToAction("Index");
         }
 
-
         protected override void Dispose(bool disposing)
         {
             if (disposing)
@@ -203,4 +198,4 @@ protected override void Dispose(bool disposing)
             base.Dispose(disposing);
         }
     }
-}
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Controllers/SecureController.cs b/AspNetIdentity2GroupPermissions/Controllers/SecureController.cs
new file mode 100644
index 0000000..78c21b8
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Controllers/SecureController.cs
@@ -0,0 +1,27 @@
+using IdentitySample.Models;
+using System.Web.Mvc;
+
+namespace IdentitySample.Controllers
+{
+    [PermissionFilter]
+    public class SecureController : Controller
+    {
+        // GET: Secure
+        public ActionResult Index()
+        {
+            return View();
+        }
+
+        // GET: Secure/Details/5
+        public ActionResult Details(int id)
+        {
+            return View();
+        }
+
+        // GET: Secure/Create
+        public ActionResult Create()
+        {
+            return View();
+        }
+    }
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Migrations/Configuration.cs b/AspNetIdentity2GroupPermissions/Migrations/Configuration.cs
new file mode 100644
index 0000000..f5fed03
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Migrations/Configuration.cs
@@ -0,0 +1,49 @@
+namespace IdentitySample.Migrations
+{
+    using IdentitySample.Models;
+    using Microsoft.AspNet.Identity;
+    using System.Data.Entity.Migrations;
+
+    internal sealed class Configuration : DbMigrationsConfiguration<ApplicationDbContext>
+    {
+        public Configuration()
+        {
+            AutomaticMigrationsEnabled = true;
+            ContextKey = "IdentitySample.Models.ApplicationDbContext";
+        }
+
+        protected override void Seed(ApplicationDbContext context)
+        {
+            context.ApplicationActionPermissions.AddOrUpdate(new ApplicationActionPermission { ActionName = "Create", ControllerName = "ActionPermissionController", Id = 1 });
+            var roleManager = new ApplicationRoleManager(new ApplicationRoleStore(context));
+            var userManager = new ApplicationUserManager(new ApplicationUserStore(context));
+
+            const string name = "admin@example.com";
+            const string password = "Admin@123456";
+            const string roleName = "Admin";
+
+            //Create Role Admin if it does not exist
+            var role = roleManager.FindByName(roleName);
+            if (role == null)
+            {
+                role = new ApplicationRole(roleName);
+                var roleresult = roleManager.Create(role);
+            }
+
+            var user = userManager.FindByName(name);
+            if (user == null)
+            {
+                user = new ApplicationUser { UserName = name, Email = name, EmailConfirmed = true };
+                var result = userManager.Create(user, password);
+                result = userManager.SetLockoutEnabled(user.Id, false);
+            }
+
+            var groupManager = new ApplicationGroupManager(context, userManager, roleManager);
+            var newGroup = new ApplicationGroup("SuperAdmins", "Full Access to All") { IsAdmin = true };
+
+            groupManager.CreateGroup(newGroup);
+            groupManager.SetUserGroups(user.Id, new string[] { newGroup.Id });
+            groupManager.SetGroupRoles(newGroup.Id, new string[] { role.Name });
+        }
+    }
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Models/ActionPermissionManager.cs b/AspNetIdentity2GroupPermissions/Models/ActionPermissionManager.cs
new file mode 100644
index 0000000..34c0b3a
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Models/ActionPermissionManager.cs
@@ -0,0 +1,237 @@
+using Microsoft.AspNet.Identity;
+using Microsoft.AspNet.Identity.Owin;
+using System;
+using System.Collections.Generic;
+using System.Data.Entity;
+using System.Linq;
+using System.Threading.Tasks;
+using System.Web;
+using System.Web.Helpers;
+
+namespace IdentitySample.Models
+{
+    public class ActionPermissionManager : IDisposable
+    {
+        private ActionPermissionsStoreBase _actionPermissionStore;
+
+        private ApplicationDbContext _db;
+
+        private bool _disposed;
+        private readonly ApplicationRoleManager _roleManager;
+
+        private readonly ApplicationUserManager _userManager;
+
+        public ActionPermissionManager()
+        {
+            _db = HttpContext.Current
+                .GetOwinContext().Get<ApplicationDbContext>();
+            _roleManager = HttpContext.Current
+               .GetOwinContext().Get<ApplicationRoleManager>();
+            _actionPermissionStore = new ActionPermissionsStoreBase(_db);
+            _userManager = new ApplicationUserManager(new ApplicationUserStore(_db));
+        }
+
+        public IQueryable<ApplicationActionPermission> ActionPermissions
+        {
+            get
+            {
+                return _actionPermissionStore.EntitySet;
+            }
+        }
+
+        public IdentityResult AddPermissionRoles(int actionId, params string[] roles)
+        {
+            ThrowIfDisposed();
+            var actionPermission = _actionPermissionStore.GetById(actionId);
+
+            ClearActionRoles(actionId);
+
+            var newRoles = _roleManager.Roles.Where(r => roles.Any(n => n == r.Name));
+
+            foreach (var role in newRoles)
+            {
+                actionPermission.Roles.Add(role);
+            }
+            _db.SaveChanges();
+            var key = string.Format("{0}/{1}", actionPermission.ControllerName, actionPermission.ActionName);
+            WebCache.Remove(key);
+            return IdentityResult.Success;
+        }
+
+        public async Task<IdentityResult> AddPermissionRolesAsync(int actionId, params string[] roles)
+        {
+            ThrowIfDisposed();
+            var actionPermission = _actionPermissionStore.GetById(actionId);
+            ClearActionRoles(actionId);
+
+            var newRoles = _roleManager.Roles.Where(r => roles.Any(n => n == r.Name));
+            if(actionPermission.Roles == null)
+                actionPermission.Roles = new List<ApplicationRole>();
+
+            foreach (var role in newRoles)
+            {
+                actionPermission.Roles.Add(role);
+            }
+            await _db.SaveChangesAsync();
+            var key = string.Format("{0}/{1}", actionPermission.ControllerName, actionPermission.ActionName);
+            WebCache.Remove(key);
+            return IdentityResult.Success;
+        }
+
+        public bool CreateActionPermission(ApplicationActionPermission permission)
+        {
+            ThrowIfDisposed();
+            if (permission == null)
+                throw new ArgumentNullException("permission");
+
+            if (!_actionPermissionStore.EntitySet.Any(x => x.ActionName == permission.ActionName && x.ControllerName == permission.ControllerName))
+                _actionPermissionStore.Create(permission);
+            return true;
+        }
+
+        public async Task<bool> CreateActionPermissionAsync(ApplicationActionPermission permission)
+        {
+            ThrowIfDisposed();
+            if (permission == null)
+                throw new ArgumentNullException("permission");
+
+            if (!_actionPermissionStore.EntitySet.Any(x => x.ActionName == permission.ActionName && x.ControllerName == permission.ControllerName))
+                await _actionPermissionStore.CreateAsync(permission);
+            return true;
+        }
+
+        public bool Delete(int actionId)
+        {
+            ThrowIfDisposed();
+            var actionPermission = _actionPermissionStore.GetById(actionId);
+            if (actionPermission == null)
+                throw new ArgumentException("Action Permission not found");
+            ClearActionRoles(actionId);
+            _actionPermissionStore.Delete(actionPermission);
+            return true;
+        }
+
+        public async Task<bool> DeleteAsync(int actionId)
+        {
+            ThrowIfDisposed();
+            var actionPermission = await _actionPermissionStore.GetByIdAsync(actionId);
+            if (actionPermission == null)
+                throw new ArgumentException("Action Permission not found");
+            ClearActionRoles(actionId);
+            await _actionPermissionStore.DeleteAsync(actionPermission);
+            return true;
+        }
+
+        public void Dispose()
+        {
+            this.Dispose(true);
+            GC.SuppressFinalize(this);
+        }
+
+        public ApplicationActionPermission GetById(int id)
+        {
+            return _actionPermissionStore.GetById(id);
+        }
+
+        public Task<ApplicationActionPermission> GetByIdAsync(int id)
+        {
+            return _actionPermissionStore.GetByIdAsync(id);
+        }
+
+        public IEnumerable<ApplicationRole> GetControllerActionRoles(int actionId)
+        {
+            var perm = GetById(actionId);
+
+            return perm.Roles;
+        }
+
+        public IEnumerable<ApplicationRole> GetControllerActionRoles()
+        {
+            var perm = _db.ApplicationActionPermissionRoles.ToList();
+            var roles = _roleManager.Roles.ToList();
+            var permRoles = from r in roles
+                            where perm.Any(ap => ap.RoleId == r.Id)
+                            select r;
+            return permRoles;
+        }
+
+        public bool UpdateActionPermission(ApplicationActionPermission permission)
+        {
+            ThrowIfDisposed();
+            if (permission == null)
+                throw new ArgumentNullException("permission");
+
+            _actionPermissionStore.Update(permission);
+            return true;
+        }
+
+        public async Task<bool> UpdateActionPermissionAsync(ApplicationActionPermission permission)
+        {
+            ThrowIfDisposed();
+            if (permission == null)
+                throw new ArgumentNullException("permission");
+
+            await _actionPermissionStore.UpdateAsync(permission);
+            return true;
+        }
+
+        public IEnumerable<ApplicationRole> GetActionRoles(string controller, string action)
+        {
+            //Check from the cache 1st
+            var key = string.Format("{0}/{1}", controller, action);
+            var roles = WebCache.Get(key) as List<ApplicationRole>;
+            if (roles != null)
+                return roles;
+
+            var perm =
+                 _db.ApplicationActionPermissions.FirstOrDefault(a => a.ActionName == action & a.ControllerName == controller);
+
+            if (perm == null) return new List<ApplicationRole>();
+            roles = GetControllerActionRoles(perm.Id).ToList();
+            WebCache.Set(key, roles);
+            return roles;
+        }
+
+        public bool HasPermission(string controller, string action, string userId)
+        {
+            var key = string.Format("{0}/{1}/{2}", controller, action, userId);
+            var userRoles = WebCache.Get(key) as IList<string>;
+            if (userRoles == null)
+            {
+                userRoles = _userManager.GetRolesAsync(userId).Result;
+                WebCache.Set(key, userRoles);
+            }
+            var requiredRoles = GetActionRoles(controller, action);
+            return requiredRoles.Any(x => userRoles.Contains(x.Name));
+        }
+
+        protected virtual void Dispose(bool disposing)
+        {
+            if (disposing && _db != null)
+            {
+                this._db.Dispose();
+            }
+            this._disposed = true;
+            this._db = null;
+            this._actionPermissionStore = null;
+        }
+
+        private void ClearActionRoles(int actionId)
+        {
+            var actionPermission = _actionPermissionStore.GetById(actionId);
+            if (actionPermission.Roles != null)
+            {
+                actionPermission.Roles.Clear();
+                _db.SaveChanges();
+            }
+        }
+
+        private void ThrowIfDisposed()
+        {
+            if (this._disposed)
+            {
+                throw new ObjectDisposedException(this.GetType().Name);
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Models/ActionPermissionsStoreBase.cs b/AspNetIdentity2GroupPermissions/Models/ActionPermissionsStoreBase.cs
new file mode 100644
index 0000000..2dc4ea1
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Models/ActionPermissionsStoreBase.cs
@@ -0,0 +1,94 @@
+using System;
+using System.Collections.Generic;
+using System.Data.Entity;
+using System.Linq;
+using System.Threading.Tasks;
+using System.Web;
+
+namespace IdentitySample.Models
+{
+    /// TODO : Convert to generic of T
+    public class ActionPermissionsStoreBase
+    {
+        public ActionPermissionsStoreBase(DbContext context)
+        {
+            if (context == null)
+                throw new ArgumentNullException("context");
+
+            this.Context = context;
+            this.DbEntitySet = context.Set<ApplicationActionPermission>();
+        }
+
+        public DbContext Context
+        {
+            get;
+            private set;
+        }
+
+        public DbSet<ApplicationActionPermission> DbEntitySet
+        {
+            get;
+            private set;
+        }
+
+        public IQueryable<ApplicationActionPermission> EntitySet
+        {
+            get
+            {
+                return this.DbEntitySet;
+            }
+        }
+
+        public virtual void Create(ApplicationActionPermission entity)
+        {
+            this.DbEntitySet.Add(entity);
+            this.Context.SaveChanges();
+        }
+
+        public virtual Task CreateAsync(ApplicationActionPermission entity)
+        {
+            this.DbEntitySet.Add(entity);
+            return this.Context.SaveChangesAsync();
+        }
+
+        public void Delete(ApplicationActionPermission entity)
+        {
+            this.DbEntitySet.Remove(entity);
+            this.Context.SaveChanges();
+        }
+
+        public virtual Task DeleteAsync(ApplicationActionPermission entity)
+        {
+            this.DbEntitySet.Remove(entity);
+            return this.Context.SaveChangesAsync();
+        }
+
+        public virtual ApplicationActionPermission GetById(object id)
+        {
+            return this.DbEntitySet.Find(new object[] { id });
+        }
+
+        public virtual Task<ApplicationActionPermission> GetByIdAsync(object id)
+        {
+            return this.DbEntitySet.FindAsync(new object[] { id });
+        }
+
+        public virtual void Update(ApplicationActionPermission entity)
+        {
+            if (entity != null)
+            {
+                this.Context.Entry<ApplicationActionPermission>(entity).State = EntityState.Modified;
+            }
+            this.Context.SaveChanges();
+        }
+
+        public virtual Task UpdateAsync(ApplicationActionPermission entity)
+        {
+            if (entity != null)
+            {
+                this.Context.Entry<ApplicationActionPermission>(entity).State = EntityState.Modified;
+            }
+            return this.Context.SaveChangesAsync();
+        }
+    }
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Models/AdminViewModel.cs b/AspNetIdentity2GroupPermissions/Models/AdminViewModel.cs
index 47c2beb..de9e337 100644
--- a/AspNetIdentity2GroupPermissions/Models/AdminViewModel.cs
+++ b/AspNetIdentity2GroupPermissions/Models/AdminViewModel.cs
@@ -4,14 +4,6 @@
 
 namespace IdentitySample.Models
 {
-    public class RoleViewModel
-    {
-        public string Id { get; set; }
-        [Required(AllowEmptyStrings = false)]
-        [Display(Name = "RoleName")]
-        public string Name { get; set; }
-    }
-
     public class EditUserViewModel
     {
         public EditUserViewModel()
@@ -19,17 +11,19 @@ public EditUserViewModel()
             this.RolesList = new List<SelectListItem>();
             this.GroupsList = new List<SelectListItem>();
         }
-        public string Id { get; set; }
+
         [Required(AllowEmptyStrings = false)]
         [Display(Name = "Email")]
         [EmailAddress]
         public string Email { get; set; }
 
-        // We will still use this, so leave it here:
-        public ICollection<SelectListItem> RolesList { get; set; }
-
         // Add a GroupsList Property:
         public ICollection<SelectListItem> GroupsList { get; set; }
+
+        public string Id { get; set; }
+
+        // We will still use this, so leave it here:
+        public ICollection<SelectListItem> RolesList { get; set; }
     }
 
     public class GroupViewModel
@@ -39,12 +33,56 @@ public GroupViewModel()
             this.UsersList = new List<SelectListItem>();
             this.RolesList = new List<SelectListItem>();
         }
+
+        public string Description { get; set; }
+
         [Required(AllowEmptyStrings = false)]
         public string Id { get; set; }
+
         [Required(AllowEmptyStrings = false)]
         public string Name { get; set; }
-        public string Description { get; set; }
+
+        public bool IsAdmin { get; set; }
+
+        public ICollection<SelectListItem> RolesList { get; set; }
+
         public ICollection<SelectListItem> UsersList { get; set; }
+    }
+
+    public class PermissionViewModel
+    {
+        public PermissionViewModel()
+        {
+            this.RolesList = new List<SelectListItem>();
+        }
+
+        [Required(AllowEmptyStrings = false)]
+        public string ActionName { get; set; }
+
+        [Required(AllowEmptyStrings = false)]
+        public string ControllerName { get; set; }
+
+        [Required]
+        public int Id { get; set; }
+
         public ICollection<SelectListItem> RolesList { get; set; }
     }
+
+    public class RoleViewModel
+    {
+        public string Id { get; set; }
+
+        [Required(AllowEmptyStrings = false)]
+        [Display(Name = "RoleName")]
+        public string Name { get; set; }
+    }
+
+    public class ActionViewModel
+    {
+        public int Id { get; set; }
+
+        public string Controller { get; set; }
+
+        public int Actions { get; set; }
+    }
 }
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Models/ApplicationActionPermission.cs b/AspNetIdentity2GroupPermissions/Models/ApplicationActionPermission.cs
new file mode 100644
index 0000000..a2c1ecd
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Models/ApplicationActionPermission.cs
@@ -0,0 +1,35 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+using System.Linq;
+using System.Web;
+
+namespace IdentitySample.Models
+{
+    public class ApplicationActionPermission
+    {
+        public ApplicationActionPermission()
+        {
+        }
+
+        public ApplicationActionPermission(string actionName, string controllerName)
+            : this()
+        {
+            this.ActionName = actionName;
+            this.ControllerName = controllerName;
+            this.Roles = new Collection<ApplicationRole>();
+        }
+
+        public virtual string ActionName { get; set; }
+
+        public virtual string ControllerName { get; set; }
+
+        [Key]
+        [Required]
+        public virtual int Id { get; set; }
+
+        public virtual ICollection<ApplicationRole> Roles { get; set; }
+    }
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Models/ApplicationActionPermissionRole.cs b/AspNetIdentity2GroupPermissions/Models/ApplicationActionPermissionRole.cs
new file mode 100644
index 0000000..5aa83c5
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Models/ApplicationActionPermissionRole.cs
@@ -0,0 +1,13 @@
+namespace IdentitySample.Models
+{
+    public class ApplicationActionPermissionRole
+    {
+        public virtual int PermissionId { get; set; }
+
+        public virtual ApplicationActionPermission Permission { get; set; }
+
+        public virtual ApplicationRole Role { get; set; }
+
+        public virtual string RoleId { get; set; }
+    }
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Models/ApplicationGroupManager.cs b/AspNetIdentity2GroupPermissions/Models/ApplicationGroupManager.cs
index 47e9deb..de4ebf7 100644
--- a/AspNetIdentity2GroupPermissions/Models/ApplicationGroupManager.cs
+++ b/AspNetIdentity2GroupPermissions/Models/ApplicationGroupManager.cs
@@ -7,15 +7,14 @@
 using System.Threading.Tasks;
 using System.Web;
 
-
 namespace IdentitySample.Models
 {
     public class ApplicationGroupManager
     {
-        private ApplicationGroupStore _groupStore;
         private ApplicationDbContext _db;
-        private ApplicationUserManager _userManager;
+        private ApplicationGroupStore _groupStore;
         private ApplicationRoleManager _roleManager;
+        private ApplicationUserManager _userManager;
 
         public ApplicationGroupManager()
         {
@@ -28,6 +27,13 @@ public ApplicationGroupManager()
             _groupStore = new ApplicationGroupStore(_db);
         }
 
+        public ApplicationGroupManager(ApplicationDbContext db, ApplicationUserManager userManager, ApplicationRoleManager roleManager)
+        {
+            _db = db;
+            _userManager = userManager;
+            _roleManager = roleManager;
+            _groupStore = new ApplicationGroupStore(db);
+        }
 
         public IQueryable<ApplicationGroup> Groups
         {
@@ -37,13 +43,15 @@ public IQueryable<ApplicationGroup> Groups
             }
         }
 
-
-        public async Task<IdentityResult> CreateGroupAsync(ApplicationGroup group)
+        public IdentityResult ClearUserGroups(string userId)
         {
-            await _groupStore.CreateAsync(group);
-            return IdentityResult.Success;
+            return this.SetUserGroups(userId, new string[] { });
         }
 
+        public async Task<IdentityResult> ClearUserGroupsAsync(string userId)
+        {
+            return await this.SetUserGroupsAsync(userId, new string[] { });
+        }
 
         public IdentityResult CreateGroup(ApplicationGroup group)
         {
@@ -51,113 +59,181 @@ public IdentityResult CreateGroup(ApplicationGroup group)
             return IdentityResult.Success;
         }
 
-
-        public IdentityResult SetGroupRoles(string groupId, params string[] roleNames)
+        public async Task<IdentityResult> CreateGroupAsync(ApplicationGroup group)
         {
-            // Clear all the roles associated with this group:
-            var thisGroup = this.FindById(groupId);
-            thisGroup.ApplicationRoles.Clear();
-            _db.SaveChanges();
+            await _groupStore.CreateAsync(group);
+            return IdentityResult.Success;
+        }
 
-            // Add the new roles passed in:
-            var newRoles = _roleManager.Roles.Where(r => roleNames.Any(n => n == r.Name));
-            foreach(var role in newRoles)
+        public IdentityResult DeleteGroup(string groupId)
+        {
+            var group = this.FindById(groupId);
+            if (group == null)
             {
-                thisGroup.ApplicationRoles.Add(new ApplicationGroupRole { ApplicationGroupId = groupId, ApplicationRoleId = role.Id });
+                throw new ArgumentNullException("User");
             }
+
+            var currentGroupMembers = this.GetGroupUsers(groupId).ToList();
+            // remove the roles from the group:
+            group.ApplicationRoles.Clear();
+
+            // Remove all the users:
+            group.ApplicationUsers.Clear();
+
+            // Remove the group itself:
+            _db.ApplicationGroups.Remove(group);
+
             _db.SaveChanges();
 
-            // Reset the roles for all affected users:
-            foreach(var groupUser in thisGroup.ApplicationUsers)
+            // Reset all the user roles:
+            foreach (var user in currentGroupMembers)
             {
-                this.RefreshUserGroupRoles(groupUser.ApplicationUserId);
+                this.RefreshUserGroupRoles(user.Id);
             }
             return IdentityResult.Success;
         }
 
-
-        public async Task<IdentityResult> SetGroupRolesAsync(string groupId, params string[] roleNames)
+        public async Task<IdentityResult> DeleteGroupAsync(string groupId)
         {
-            // Clear all the roles associated with this group:
-            var thisGroup = await this.FindByIdAsync(groupId);
-            thisGroup.ApplicationRoles.Clear();
-            await _db.SaveChangesAsync();
-
-            // Add the new roles passed in:
-            var newRoles = _roleManager.Roles.Where(r => roleNames.Any(n => n == r.Name));
-            foreach (var role in newRoles)
+            var group = await this.FindByIdAsync(groupId);
+            if (group == null)
             {
-                thisGroup.ApplicationRoles.Add(new ApplicationGroupRole { ApplicationGroupId = groupId, ApplicationRoleId = role.Id });
+                throw new ArgumentNullException("User");
             }
+
+            var currentGroupMembers = (await this.GetGroupUsersAsync(groupId)).ToList();
+            // remove the roles from the group:
+            group.ApplicationRoles.Clear();
+
+            // Remove all the users:
+            group.ApplicationUsers.Clear();
+
+            // Remove the group itself:
+            _db.ApplicationGroups.Remove(group);
+
             await _db.SaveChangesAsync();
 
-            // Reset the roles for all affected users:
-            foreach (var groupUser in thisGroup.ApplicationUsers)
+            // Reset all the user roles:
+            foreach (var user in currentGroupMembers)
             {
-                await this.RefreshUserGroupRolesAsync(groupUser.ApplicationUserId);
+                await this.RefreshUserGroupRolesAsync(user.Id);
             }
             return IdentityResult.Success;
         }
 
+        public ApplicationGroup FindById(string id)
+        {
+            return _groupStore.FindById(id);
+        }
 
-        public async Task<IdentityResult> SetUserGroupsAsync(string userId, params string[] groupIds)
+        public async Task<ApplicationGroup> FindByIdAsync(string id)
         {
-            // Clear current group membership:
-            var currentGroups = await this.GetUserGroupsAsync(userId);
-            foreach (var group in currentGroups)
+            return await _groupStore.FindByIdAsync(id);
+        }
+
+        public IEnumerable<ApplicationRole> GetGroupRoles(string groupId)
+        {
+            var grp = _db.ApplicationGroups.FirstOrDefault(g => g.Id == groupId);
+            var roles = _roleManager.Roles.ToList();
+            var groupRoles = from r in roles
+                             where grp.ApplicationRoles.Any(ap => ap.ApplicationRoleId == r.Id)
+                             select r;
+            return groupRoles;
+        }
+
+        public async Task<IEnumerable<ApplicationRole>> GetGroupRolesAsync(string groupId)
+        {
+            var grp = await _db.ApplicationGroups.FirstOrDefaultAsync(g => g.Id == groupId);
+            var roles = await _roleManager.Roles.ToListAsync();
+            var groupRoles = (from r in roles
+                              where grp.ApplicationRoles.Any(ap => ap.ApplicationRoleId == r.Id)
+                              select r).ToList();
+            return groupRoles;
+        }
+
+        public IEnumerable<ApplicationUser> GetGroupUsers(string groupId)
+        {
+            var group = this.FindById(groupId);
+            var users = new List<ApplicationUser>();
+            foreach (var groupUser in group.ApplicationUsers)
             {
-                group.ApplicationUsers
-                    .Remove(group.ApplicationUsers.FirstOrDefault(gr => gr.ApplicationUserId == userId));
+                var user = _db.Users.Find(groupUser.ApplicationUserId);
+                users.Add(user);
             }
-            await _db.SaveChangesAsync();
+            return users;
+        }
 
-            // Add the user to the new groups:
-            foreach (string groupId in groupIds)
+        public async Task<IEnumerable<ApplicationUser>> GetGroupUsersAsync(string groupId)
+        {
+            var group = await this.FindByIdAsync(groupId);
+            var users = new List<ApplicationUser>();
+            foreach (var groupUser in group.ApplicationUsers)
             {
-                var newGroup = await this.FindByIdAsync(groupId);
-                newGroup.ApplicationUsers.Add(new ApplicationUserGroup { ApplicationUserId = userId, ApplicationGroupId = groupId });
+                var user = await _db.Users
+                    .FirstOrDefaultAsync(u => u.Id == groupUser.ApplicationUserId);
+                users.Add(user);
             }
-            await _db.SaveChangesAsync();
-
-            await this.RefreshUserGroupRolesAsync(userId);
-            return IdentityResult.Success;
+            return users;
         }
 
-
-        public IdentityResult SetUserGroups(string userId, params string[] groupIds)
+        public IEnumerable<ApplicationGroupRole> GetUserGroupRoles(string userId)
         {
-            // Clear current group membership:
-            var currentGroups = this.GetUserGroups(userId);
-            foreach(var group in currentGroups)
+            var userGroups = this.GetUserGroups(userId);
+            var userGroupRoles = new List<ApplicationGroupRole>();
+            foreach (var group in userGroups)
             {
-                group.ApplicationUsers
-                    .Remove(group.ApplicationUsers.FirstOrDefault(gr => gr.ApplicationUserId == userId));
+                userGroupRoles.AddRange(group.ApplicationRoles.ToArray());
             }
-            _db.SaveChanges();
+            return userGroupRoles;
+        }
 
-            // Add the user to the new groups:
-            foreach(string groupId in groupIds)
+        public async Task<IEnumerable<ApplicationGroupRole>> GetUserGroupRolesAsync(string userId)
+        {
+            var userGroups = await this.GetUserGroupsAsync(userId);
+            var userGroupRoles = new List<ApplicationGroupRole>();
+            foreach (var group in userGroups)
             {
-                var newGroup = this.FindById(groupId);
-                newGroup.ApplicationUsers.Add(new ApplicationUserGroup { ApplicationUserId = userId, ApplicationGroupId = groupId });
+                userGroupRoles.AddRange(group.ApplicationRoles.ToArray());
             }
-            _db.SaveChanges();
+            return userGroupRoles;
+        }
 
-            this.RefreshUserGroupRoles(userId);
-            return IdentityResult.Success;
+        public IEnumerable<ApplicationGroup> GetUserGroups(string userId)
+        {
+            var result = new List<ApplicationGroup>();
+            var userGroups = (from g in this.Groups
+                              where g.ApplicationUsers.Any(u => u.ApplicationUserId == userId)
+                              select g).ToList();
+            return userGroups;
         }
 
+        public async Task<IEnumerable<ApplicationGroup>> GetUserGroupsAsync(string userId)
+        {
+            var result = new List<ApplicationGroup>();
+            var userGroups = (from g in this.Groups
+                              where g.ApplicationUsers.Any(u => u.ApplicationUserId == userId)
+                              select g).ToListAsync();
+            return await userGroups;
+        }
+
+        public bool UserHasAdministratorAccess(string userId)
+        {
+            return
+                (from g in Groups
+                 where g.ApplicationUsers.Any(u => u.ApplicationUserId == userId)
+                 select g).Any(x => x.IsAdmin);
+        }
 
         public IdentityResult RefreshUserGroupRoles(string userId)
         {
             var user = _userManager.FindById(userId);
-            if(user == null)
+            if (user == null)
             {
                 throw new ArgumentNullException("User");
             }
             // Remove user from previous roles:
             var oldUserRoles = _userManager.GetRoles(userId);
-            if(oldUserRoles.Count > 0)
+            if (oldUserRoles.Count > 0)
             {
                 _userManager.RemoveFromRoles(userId, oldUserRoles.ToArray());
             }
@@ -176,7 +252,6 @@ public IdentityResult RefreshUserGroupRoles(string userId)
             return IdentityResult.Success;
         }
 
-
         public async Task<IdentityResult> RefreshUserGroupRolesAsync(string userId)
         {
             var user = await _userManager.FindByIdAsync(userId);
@@ -205,201 +280,116 @@ public async Task<IdentityResult> RefreshUserGroupRolesAsync(string userId)
             return IdentityResult.Success;
         }
 
-
-        public async Task<IdentityResult> DeleteGroupAsync(string groupId)
+        public IdentityResult SetGroupRoles(string groupId, params string[] roleNames)
         {
-            var group = await this.FindByIdAsync(groupId);
-            if (group == null)
+            // Clear all the roles associated with this group:
+            var thisGroup = this.FindById(groupId);
+            thisGroup.ApplicationRoles.Clear();
+            _db.SaveChanges();
+
+            // Add the new roles passed in:
+            var newRoles = _roleManager.Roles.Where(r => roleNames.Any(n => n == r.Name));
+            foreach (var role in newRoles)
             {
-                throw new ArgumentNullException("User");
+                thisGroup.ApplicationRoles.Add(new ApplicationGroupRole { ApplicationGroupId = groupId, ApplicationRoleId = role.Id });
             }
+            _db.SaveChanges();
 
-            var currentGroupMembers = (await this.GetGroupUsersAsync(groupId)).ToList();
-            // remove the roles from the group:
-            group.ApplicationRoles.Clear();
-
-            // Remove all the users:
-            group.ApplicationUsers.Clear();
-
-            // Remove the group itself:
-            _db.ApplicationGroups.Remove(group);
-
-            await _db.SaveChangesAsync();
-
-            // Reset all the user roles:
-            foreach (var user in currentGroupMembers)
+            // Reset the roles for all affected users:
+            foreach (var groupUser in thisGroup.ApplicationUsers)
             {
-                await this.RefreshUserGroupRolesAsync(user.Id);
+                this.RefreshUserGroupRoles(groupUser.ApplicationUserId);
             }
             return IdentityResult.Success;
         }
 
-
-        public IdentityResult DeleteGroup(string groupId)
+        public async Task<IdentityResult> SetGroupRolesAsync(string groupId, params string[] roleNames)
         {
-            var group = this.FindById(groupId);
-            if(group == null)
-            {
-                throw new ArgumentNullException("User");
-            }
-
-            var currentGroupMembers = this.GetGroupUsers(groupId).ToList();
-            // remove the roles from the group:
-            group.ApplicationRoles.Clear();
-
-            // Remove all the users:
-            group.ApplicationUsers.Clear();
-
-            // Remove the group itself:
-            _db.ApplicationGroups.Remove(group);
-
-            _db.SaveChanges();
+            // Clear all the roles associated with this group:
+            var thisGroup = await this.FindByIdAsync(groupId);
+            thisGroup.ApplicationRoles.Clear();
+            await _db.SaveChangesAsync();
 
-            // Reset all the user roles:
-            foreach(var user in currentGroupMembers)
+            // Add the new roles passed in:
+            var newRoles = _roleManager.Roles.Where(r => roleNames.Any(n => n == r.Name));
+            foreach (var role in newRoles)
             {
-                this.RefreshUserGroupRoles(user.Id);
+                thisGroup.ApplicationRoles.Add(new ApplicationGroupRole { ApplicationGroupId = groupId, ApplicationRoleId = role.Id });
             }
-            return IdentityResult.Success;
-        }
-
+            await _db.SaveChangesAsync();
 
-        public async Task<IdentityResult> UpdateGroupAsync(ApplicationGroup group)
-        {
-            await _groupStore.UpdateAsync(group);
-            foreach (var groupUser in group.ApplicationUsers)
+            // Reset the roles for all affected users:
+            foreach (var groupUser in thisGroup.ApplicationUsers)
             {
                 await this.RefreshUserGroupRolesAsync(groupUser.ApplicationUserId);
             }
             return IdentityResult.Success;
         }
 
-
-        public IdentityResult UpdateGroup(ApplicationGroup group)
+        public IdentityResult SetUserGroups(string userId, params string[] groupIds)
         {
-            _groupStore.Update(group);
-            foreach(var groupUser in group.ApplicationUsers)
+            // Clear current group membership:
+            var currentGroups = this.GetUserGroups(userId);
+            foreach (var group in currentGroups)
             {
-                this.RefreshUserGroupRoles(groupUser.ApplicationUserId);
+                group.ApplicationUsers
+                    .Remove(group.ApplicationUsers.FirstOrDefault(gr => gr.ApplicationUserId == userId));
             }
-            return IdentityResult.Success;
-        }
-
-
-        public IdentityResult ClearUserGroups(string userId)
-        {
-            return this.SetUserGroups(userId, new string[] { });
-        }
-
-
-        public async Task<IdentityResult> ClearUserGroupsAsync(string userId)
-        {
-            return await this.SetUserGroupsAsync(userId, new string[] { });
-        }
-
-
-        public async Task<IEnumerable<ApplicationGroup>> GetUserGroupsAsync(string userId)
-        {
-            var result = new List<ApplicationGroup>();
-            var userGroups = (from g in this.Groups
-                              where g.ApplicationUsers.Any(u => u.ApplicationUserId == userId)
-                              select g).ToListAsync();
-            return await userGroups;
-        }
-
-
-        public IEnumerable<ApplicationGroup> GetUserGroups(string userId)
-        {
-            var result = new List<ApplicationGroup>();
-            var userGroups = (from g in this.Groups
-                              where g.ApplicationUsers.Any(u => u.ApplicationUserId == userId)
-                              select g).ToList();
-            return userGroups;
-        }
-
-
-        public async Task<IEnumerable<ApplicationRole>> GetGroupRolesAsync(string groupId)
-        {
-            var grp = await _db.ApplicationGroups.FirstOrDefaultAsync(g => g.Id == groupId);
-            var roles = await _roleManager.Roles.ToListAsync();
-            var groupRoles = (from r in roles
-                              where grp.ApplicationRoles.Any(ap => ap.ApplicationRoleId == r.Id)
-                              select r).ToList();
-            return groupRoles;
-        }
+            _db.SaveChanges();
 
+            // Add the user to the new groups:
+            foreach (string groupId in groupIds)
+            {
+                var newGroup = this.FindById(groupId);
+                newGroup.ApplicationUsers.Add(new ApplicationUserGroup { ApplicationUserId = userId, ApplicationGroupId = groupId });
+            }
+            _db.SaveChanges();
 
-        public IEnumerable<ApplicationRole> GetGroupRoles(string groupId)
-        {
-            var grp = _db.ApplicationGroups.FirstOrDefault(g => g.Id == groupId);
-            var roles = _roleManager.Roles.ToList();
-            var groupRoles = from r in roles
-                             where grp.ApplicationRoles.Any(ap => ap.ApplicationRoleId == r.Id)
-                             select r;
-            return groupRoles;
+            this.RefreshUserGroupRoles(userId);
+            return IdentityResult.Success;
         }
 
-
-        public IEnumerable<ApplicationUser> GetGroupUsers(string groupId)
+        public async Task<IdentityResult> SetUserGroupsAsync(string userId, params string[] groupIds)
         {
-            var group = this.FindById(groupId);
-            var users = new List<ApplicationUser>();
-            foreach (var groupUser in group.ApplicationUsers)
+            // Clear current group membership:
+            var currentGroups = await this.GetUserGroupsAsync(userId);
+            foreach (var group in currentGroups)
             {
-                var user = _db.Users.Find(groupUser.ApplicationUserId);
-                users.Add(user);
+                group.ApplicationUsers
+                    .Remove(group.ApplicationUsers.FirstOrDefault(gr => gr.ApplicationUserId == userId));
             }
-            return users;
-        }
-
+            await _db.SaveChangesAsync();
 
-        public async Task<IEnumerable<ApplicationUser>> GetGroupUsersAsync(string groupId)
-        {
-            var group = await this.FindByIdAsync(groupId);
-            var users = new List<ApplicationUser>();
-            foreach (var groupUser in group.ApplicationUsers)
+            // Add the user to the new groups:
+            foreach (string groupId in groupIds)
             {
-                var user = await _db.Users
-                    .FirstOrDefaultAsync(u => u.Id == groupUser.ApplicationUserId);
-                users.Add(user);
+                var newGroup = await this.FindByIdAsync(groupId);
+                newGroup.ApplicationUsers.Add(new ApplicationUserGroup { ApplicationUserId = userId, ApplicationGroupId = groupId });
             }
-            return users;
-        }
+            await _db.SaveChangesAsync();
 
+            await this.RefreshUserGroupRolesAsync(userId);
+            return IdentityResult.Success;
+        }
 
-        public IEnumerable<ApplicationGroupRole> GetUserGroupRoles(string userId)
+        public IdentityResult UpdateGroup(ApplicationGroup group)
         {
-            var userGroups = this.GetUserGroups(userId);
-            var userGroupRoles = new List<ApplicationGroupRole>();
-            foreach(var group in userGroups)
+            _groupStore.Update(group);
+            foreach (var groupUser in group.ApplicationUsers)
             {
-                userGroupRoles.AddRange(group.ApplicationRoles.ToArray());
+                this.RefreshUserGroupRoles(groupUser.ApplicationUserId);
             }
-            return userGroupRoles;
+            return IdentityResult.Success;
         }
 
-
-        public async Task<IEnumerable<ApplicationGroupRole>> GetUserGroupRolesAsync(string userId)
+        public async Task<IdentityResult> UpdateGroupAsync(ApplicationGroup group)
         {
-            var userGroups = await this.GetUserGroupsAsync(userId);
-            var userGroupRoles = new List<ApplicationGroupRole>();
-            foreach (var group in userGroups)
+            await _groupStore.UpdateAsync(group);
+            foreach (var groupUser in group.ApplicationUsers)
             {
-                userGroupRoles.AddRange(group.ApplicationRoles.ToArray());
+                await this.RefreshUserGroupRolesAsync(groupUser.ApplicationUserId);
             }
-            return userGroupRoles;
-        }
-
-
-        public async Task<ApplicationGroup> FindByIdAsync(string id)
-        {
-            return await _groupStore.FindByIdAsync(id);
-        }
-
-
-        public ApplicationGroup FindById(string id)
-        {
-            return _groupStore.FindById(id);
+            return IdentityResult.Success;
         }
     }
 }
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Models/IdentityModels.cs b/AspNetIdentity2GroupPermissions/Models/IdentityModels.cs
index 95864fd..acafac4 100644
--- a/AspNetIdentity2GroupPermissions/Models/IdentityModels.cs
+++ b/AspNetIdentity2GroupPermissions/Models/IdentityModels.cs
@@ -1,138 +1,135 @@
 using Microsoft.AspNet.Identity;
 using Microsoft.AspNet.Identity.EntityFramework;
+using System;
+using System.Collections.Generic;
+using System.ComponentModel.DataAnnotations;
 using System.Data.Entity;
 using System.Security.Claims;
 using System.Threading.Tasks;
-using System.ComponentModel.DataAnnotations;
-using System;
-using System.Collections.Generic;
+
 namespace IdentitySample.Models
 {
-    // You will not likely need to customize there, but it is necessary/easier to create our own 
-    // project-specific implementations, so here they are:
-    public class ApplicationUserLogin : IdentityUserLogin<string> { }
-    public class ApplicationUserClaim : IdentityUserClaim<string> { }
-    public class ApplicationUserRole : IdentityUserRole<string> { }
-
-    // Must be expressed in terms of our custom Role and other types:
-    public class ApplicationUser 
-        : IdentityUser<string, ApplicationUserLogin, 
-        ApplicationUserRole, ApplicationUserClaim>
-    {
-        public ApplicationUser()
-        {
-            this.Id = Guid.NewGuid().ToString();
-
-            // Add any custom User properties/code here
-        }
-
-
-        public async Task<ClaimsIdentity>
-            GenerateUserIdentityAsync(ApplicationUserManager manager)
-        {
-            var userIdentity = await manager
-                .CreateIdentityAsync(this, DefaultAuthenticationTypes.ApplicationCookie);
-            return userIdentity;
-        }
-    }
-
-
-    // Must be expressed in terms of our custom UserRole:
-    public class ApplicationRole : IdentityRole<string, ApplicationUserRole>
-    {
-        public ApplicationRole() 
-        {
-            this.Id = Guid.NewGuid().ToString();
-        }
-
-        public ApplicationRole(string name)
-            : this()
-        {
-            this.Name = name;
-        }
-
-        // Add any custom Role properties/code here
-    }
-
-
     // Must be expressed in terms of our custom types:
     public class ApplicationDbContext
         : IdentityDbContext<ApplicationUser, ApplicationRole,
         string, ApplicationUserLogin, ApplicationUserRole, ApplicationUserClaim>
     {
-        public ApplicationDbContext()
-            : base("DefaultConnection")
+        static ApplicationDbContext()
         {
+            //Database.SetInitializer<ApplicationDbContext>(new ApplicationDbInitializer());
         }
 
-        static ApplicationDbContext()
+        public ApplicationDbContext()
+            : base("DefaultConnection")
         {
-            Database.SetInitializer<ApplicationDbContext>(new ApplicationDbInitializer());
         }
 
+        public virtual IDbSet<ApplicationActionPermissionRole> ApplicationActionPermissionRoles { get; set; }
+
+        public virtual IDbSet<ApplicationActionPermission> ApplicationActionPermissions { get; set; }
+
+        // Add the ApplicationGroups property:
+        public virtual IDbSet<ApplicationGroup> ApplicationGroups { get; set; }
+
         public static ApplicationDbContext Create()
         {
             return new ApplicationDbContext();
         }
 
-        // Add the ApplicationGroups property:
-        public virtual IDbSet<ApplicationGroup> ApplicationGroups { get; set; }
-
         // Override OnModelsCreating:
         protected override void OnModelCreating(DbModelBuilder modelBuilder)
         {
             base.OnModelCreating(modelBuilder);
 
+            modelBuilder.Entity<ApplicationActionPermission>().HasMany<ApplicationRole>(x => x.Roles);
+            modelBuilder.Entity<ApplicationActionPermissionRole>().HasKey(x => new { RoleId = x.RoleId, PermissionId = x.PermissionId }).ToTable("ApplicationPermissionRoles");
+
             modelBuilder.Entity<ApplicationGroup>()
                 .HasMany<ApplicationUserGroup>((ApplicationGroup g) => g.ApplicationUsers)
                 .WithRequired().HasForeignKey<string>((ApplicationUserGroup ag) => ag.ApplicationGroupId);
             modelBuilder.Entity<ApplicationUserGroup>()
-                .HasKey((ApplicationUserGroup r) => 
-                    new 
-                    { 
-                        ApplicationUserId = r.ApplicationUserId, 
-                        ApplicationGroupId = r.ApplicationGroupId 
+                .HasKey((ApplicationUserGroup r) =>
+                    new
+                    {
+                        ApplicationUserId = r.ApplicationUserId,
+                        ApplicationGroupId = r.ApplicationGroupId
                     }).ToTable("ApplicationUserGroups");
 
             modelBuilder.Entity<ApplicationGroup>()
                 .HasMany<ApplicationGroupRole>((ApplicationGroup g) => g.ApplicationRoles)
                 .WithRequired().HasForeignKey<string>((ApplicationGroupRole ap) => ap.ApplicationGroupId);
-            modelBuilder.Entity<ApplicationGroupRole>().HasKey((ApplicationGroupRole gr) => 
-                new 
-                { 
-                    ApplicationRoleId = gr.ApplicationRoleId, 
-                    ApplicationGroupId = gr.ApplicationGroupId 
+            modelBuilder.Entity<ApplicationGroupRole>().HasKey((ApplicationGroupRole gr) =>
+                new
+                {
+                    ApplicationRoleId = gr.ApplicationRoleId,
+                    ApplicationGroupId = gr.ApplicationGroupId
                 }).ToTable("ApplicationGroupRoles");
+        }
+    }
+
+    public class ApplicationGroup
+    {
+        public ApplicationGroup()
+        {
+            this.Id = Guid.NewGuid().ToString();
+            this.ApplicationRoles = new List<ApplicationGroupRole>();
+            this.ApplicationUsers = new List<ApplicationUserGroup>();
+        }
+
+        public ApplicationGroup(string name)
+            : this()
+        {
+            this.Name = name;
+        }
 
+        public ApplicationGroup(string name, string description)
+            : this(name)
+        {
+            this.Description = description;
         }
+
+        public virtual ICollection<ApplicationGroupRole> ApplicationRoles { get; set; }
+
+        public virtual ICollection<ApplicationUserGroup> ApplicationUsers { get; set; }
+
+        public string Description { get; set; }
+
+        [Key]
+        public string Id { get; set; }
+
+        public string Name { get; set; }
+
+        public bool IsAdmin { get; set; }
     }
 
+    public class ApplicationGroupRole
+    {
+        public string ApplicationGroupId { get; set; }
+
+        public string ApplicationRoleId { get; set; }
+    }
 
-    // Most likely won't need to customize these either, but they were needed because we implemented
-    // custom versions of all the other types:
-    public class ApplicationUserStore 
-        :UserStore<ApplicationUser, ApplicationRole, string,
-            ApplicationUserLogin, ApplicationUserRole, 
-            ApplicationUserClaim>, IUserStore<ApplicationUser, string>, 
-        IDisposable
+    // Must be expressed in terms of our custom UserRole:
+    public class ApplicationRole : IdentityRole<string, ApplicationUserRole>
     {
-        public ApplicationUserStore()
-            : this(new IdentityDbContext())
+        public ApplicationRole()
         {
-            base.DisposeContext = true;
+            this.Id = Guid.NewGuid().ToString();
         }
 
-        public ApplicationUserStore(DbContext context)
-            : base(context)
+        public ApplicationRole(string name)
+            : this()
         {
+            this.Name = name;
         }
-    }
 
+        // Add any custom Role properties/code here
+    }
 
     public class ApplicationRoleStore
-    : RoleStore<ApplicationRole, string, ApplicationUserRole>,
-    IQueryableRoleStore<ApplicationRole, string>,
-    IRoleStore<ApplicationRole, string>, IDisposable
+        : RoleStore<ApplicationRole, string, ApplicationUserRole>,
+        IQueryableRoleStore<ApplicationRole, string>,
+        IRoleStore<ApplicationRole, string>, IDisposable
     {
         public ApplicationRoleStore()
             : base(new IdentityDbContext())
@@ -146,47 +143,59 @@ public ApplicationRoleStore(DbContext context)
         }
     }
 
-
-    public class ApplicationGroup
+    // Must be expressed in terms of our custom Role and other types:
+    public class ApplicationUser
+        : IdentityUser<string, ApplicationUserLogin,
+        ApplicationUserRole, ApplicationUserClaim>
     {
-        public ApplicationGroup()
+        public ApplicationUser()
         {
             this.Id = Guid.NewGuid().ToString();
-            this.ApplicationRoles = new List<ApplicationGroupRole>();
-            this.ApplicationUsers = new List<ApplicationUserGroup>();
-        }
 
-        public ApplicationGroup(string name)
-            : this()
-        {
-            this.Name = name;
+            // Add any custom User properties/code here
         }
 
-        public ApplicationGroup(string name, string description)
-            : this(name)
+        public async Task<ClaimsIdentity>
+            GenerateUserIdentityAsync(ApplicationUserManager manager)
         {
-            this.Description = description;
+            var userIdentity = await manager
+                .CreateIdentityAsync(this, DefaultAuthenticationTypes.ApplicationCookie);
+            return userIdentity;
         }
-
-        [Key]
-        public string Id { get; set; }
-        public string Name { get; set; }
-        public string Description { get; set; }
-        public virtual ICollection<ApplicationGroupRole> ApplicationRoles { get; set; }
-        public virtual ICollection<ApplicationUserGroup> ApplicationUsers { get; set; }
     }
 
+    public class ApplicationUserClaim : IdentityUserClaim<string> { }
 
     public class ApplicationUserGroup
     {
-        public string ApplicationUserId { get; set; }
         public string ApplicationGroupId { get; set; }
+
+        public string ApplicationUserId { get; set; }
     }
 
-    public class ApplicationGroupRole
+    // You will not likely need to customize there, but it is necessary/easier to create our own
+    // project-specific implementations, so here they are:
+    public class ApplicationUserLogin : IdentityUserLogin<string> { }
+
+    public class ApplicationUserRole : IdentityUserRole<string> { }
+
+    // Most likely won't need to customize these either, but they were needed because we implemented
+    // custom versions of all the other types:
+    public class ApplicationUserStore
+        : UserStore<ApplicationUser, ApplicationRole, string,
+            ApplicationUserLogin, ApplicationUserRole,
+            ApplicationUserClaim>, IUserStore<ApplicationUser, string>,
+        IDisposable
     {
-        public string ApplicationGroupId { get; set; }
-        public string ApplicationRoleId { get; set; }
-    }
+        public ApplicationUserStore()
+            : this(new IdentityDbContext())
+        {
+            base.DisposeContext = true;
+        }
 
+        public ApplicationUserStore(DbContext context)
+            : base(context)
+        {
+        }
+    }
 }
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Models/PermissionFilter.cs b/AspNetIdentity2GroupPermissions/Models/PermissionFilter.cs
new file mode 100644
index 0000000..83c1a83
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Models/PermissionFilter.cs
@@ -0,0 +1,47 @@
+using Microsoft.AspNet.Identity;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Claims;
+using System.Web;
+using System.Web.Mvc;
+using System.Web.Routing;
+
+namespace IdentitySample.Models
+{
+    public class PermissionFilter : ActionFilterAttribute
+    {
+        private readonly ApplicationGroupManager _groupManager = new ApplicationGroupManager();
+        private readonly ActionPermissionManager _permissionManager = new ActionPermissionManager();
+
+        public override void OnActionExecuting(ActionExecutingContext filterContext)
+        {
+            var request = filterContext.HttpContext.Request;
+            var response = filterContext.HttpContext.Response;
+            if (request.IsAjaxRequest())
+            {
+                #region Preventing caching of ajax request in IE browser
+
+                response.Cache.SetExpires(DateTime.UtcNow.AddDays(-1));
+                response.Cache.SetValidUntilExpires(false);
+                response.Cache.SetCacheability(HttpCacheability.NoCache);
+                response.Cache.SetNoStore();
+
+                #endregion Preventing caching of ajax request in IE browser
+            }
+            var currentActionName = filterContext.ActionDescriptor.ActionName;
+            var currentControllerName = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName;
+            var userId = HttpContext.Current.User.Identity.GetUserId();
+
+            if (!_groupManager.UserHasAdministratorAccess(userId))
+            {
+                if (!_permissionManager.HasPermission(currentControllerName, currentActionName, userId))
+                {
+                    filterContext.Result = new RedirectToRouteResult(new RouteValueDictionary { { "controller", "Account" }, { "action", "Login" } });
+                }
+            }
+
+            base.OnActionExecuting(filterContext);
+        }
+    }
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/ActionPermission/Create.cshtml b/AspNetIdentity2GroupPermissions/Views/ActionPermission/Create.cshtml
new file mode 100644
index 0000000..c910a91
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Views/ActionPermission/Create.cshtml
@@ -0,0 +1,60 @@
+@model IdentitySample.Models.ApplicationActionPermission
+
+@{
+    ViewBag.Title = "Create";
+}
+
+<h2>Create</h2>
+
+@using (Html.BeginForm())
+{
+    @Html.AntiForgeryToken()
+
+    <div class="form-horizontal">
+        <h4>ApplicationActionPermission</h4>
+        <hr />
+        @Html.ValidationSummary(true, "", new { @class = "text-danger" })
+        <div class="form-group">
+            @Html.LabelFor(model => model.ActionName, htmlAttributes: new { @class = "control-label col-md-2" })
+            <div class="col-md-10">
+                @Html.EditorFor(model => model.ActionName, new { htmlAttributes = new { @class = "form-control" } })
+                @Html.ValidationMessageFor(model => model.ActionName, "", new { @class = "text-danger" })
+            </div>
+        </div>
+
+        <div class="form-group">
+            @Html.LabelFor(model => model.ControllerName, htmlAttributes: new { @class = "control-label col-md-2" })
+            <div class="col-md-10">
+                @Html.EditorFor(model => model.ControllerName, new { htmlAttributes = new { @class = "form-control" } })
+                @Html.ValidationMessageFor(model => model.ControllerName, "", new { @class = "text-danger" })
+            </div>
+        </div>
+        <div class="form-group">
+            <label class="col-md-2 control-label">
+                Select Group Roles
+            </label>
+            <div class="col-md-10">
+                @foreach (var item in (SelectList)ViewBag.RolesList)
+                {
+                    <div>
+                        <input type="checkbox" name="SelectedRoles" value="@item.Text" class="checkbox-inline" />
+                        @Html.Label(item.Text, new { @class = "control-label" })
+                    </div>
+                }
+            </div>
+        </div>
+        <div class="form-group">
+            <div class="col-md-offset-2 col-md-10">
+                <input type="submit" value="Create" class="btn btn-default" />
+            </div>
+        </div>
+    </div>
+}
+
+<div>
+    @Html.ActionLink("Back to List", "Index")
+</div>
+
+@section Scripts {
+    @Scripts.Render("~/bundles/jqueryval")
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/ActionPermission/Details.cshtml b/AspNetIdentity2GroupPermissions/Views/ActionPermission/Details.cshtml
new file mode 100644
index 0000000..d67881a
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Views/ActionPermission/Details.cshtml
@@ -0,0 +1,39 @@
+@model IEnumerable<IdentitySample.Models.ApplicationActionPermission>
+
+@{
+    ViewBag.Title = "Details";
+}
+
+<h2>Details</h2>
+
+<p>
+    @Html.ActionLink("Create New", "Create")
+</p>
+<table class="table">
+    <tr>
+        <th>
+            @Html.DisplayNameFor(model => model.ActionName)
+        </th>
+        <th>
+            @Html.DisplayNameFor(model => model.ControllerName)
+        </th>
+        <th></th>
+    </tr>
+
+    @foreach (var item in Model)
+    {
+        <tr>
+            <td>
+                @Html.DisplayFor(modelItem => item.ActionName)
+            </td>
+            <td>
+                @Html.DisplayFor(modelItem => item.ControllerName)
+            </td>
+            <td>
+                @Html.ActionLink("Edit", "Edit", new { id = item.Id }) |
+                @Html.ActionLink("Permissions", "Permissions", new { id = item.Id }) |
+                @Html.ActionLink("Delete", "Delete", new { id = item.Id })
+            </td>
+        </tr>
+    }
+</table>
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/ActionPermission/Edit.cshtml b/AspNetIdentity2GroupPermissions/Views/ActionPermission/Edit.cshtml
new file mode 100644
index 0000000..1d9b0ed
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Views/ActionPermission/Edit.cshtml
@@ -0,0 +1,60 @@
+@model IdentitySample.Models.PermissionViewModel
+
+@{
+    ViewBag.Title = "Edit";
+}
+
+<h2>Edit</h2>
+
+@using (Html.BeginForm())
+{
+    @Html.AntiForgeryToken()
+
+    <div class="form-horizontal">
+        <h4>PermissionViewModel</h4>
+        <hr />
+        @Html.ValidationSummary(true, "", new { @class = "text-danger" })
+        <div class="form-group">
+            @Html.LabelFor(model => model.ActionName, htmlAttributes: new { @class = "control-label col-md-2" })
+            <div class="col-md-10">
+                @Html.EditorFor(model => model.ActionName, new { htmlAttributes = new { @class = "form-control" } })
+                @Html.ValidationMessageFor(model => model.ActionName, "", new { @class = "text-danger" })
+            </div>
+        </div>
+
+        <div class="form-group">
+            @Html.LabelFor(model => model.ControllerName, htmlAttributes: new { @class = "control-label col-md-2" })
+            <div class="col-md-10">
+                @Html.EditorFor(model => model.ControllerName, new { htmlAttributes = new { @class = "form-control" } })
+                @Html.ValidationMessageFor(model => model.ControllerName, "", new { @class = "text-danger" })
+            </div>
+        </div>
+        <div class="form-group">
+            @Html.Label("Permissions", new { @class = "control-label col-md-2" })
+            <span class=" col-md-10">
+                @foreach (var item in Model.RolesList)
+                {
+                    <div>
+                        <input type="checkbox" name="selectedRoles" value="@item.Text" checked="@item.Selected" class="checkbox-inline" />
+                        @Html.Label(item.Text, new { @class = "control-label" })
+                    </div>
+                }
+            </span>
+        </div>
+        @Html.HiddenFor(model => model.Id)
+
+        <div class="form-group">
+            <div class="col-md-offset-2 col-md-10">
+                <input type="submit" value="Save" class="btn btn-default" />
+            </div>
+        </div>
+    </div>
+}
+
+<div>
+    @Html.ActionLink("Back to List", "Index")
+</div>
+
+@section Scripts {
+    @Scripts.Render("~/bundles/jqueryval")
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/ActionPermission/Index.cshtml b/AspNetIdentity2GroupPermissions/Views/ActionPermission/Index.cshtml
new file mode 100644
index 0000000..ee0bac5
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Views/ActionPermission/Index.cshtml
@@ -0,0 +1,33 @@
+@model IEnumerable<IdentitySample.Models.ActionViewModel>
+
+@{
+    ViewBag.Title = "Index";
+}
+
+<h2>Index</h2>
+
+<p>
+    @Html.ActionLink("Create New", "Create")
+</p>
+<table class="table">
+    <tr>
+        <th>Controller Name</th>
+        <th>No. of actions</th>
+    </tr>
+
+    @foreach (var item in Model)
+    {
+        <tr>
+            <td>
+                @item.Controller
+            </td>
+            <td>
+                @item.Actions
+            </td>
+            <td>
+
+                @Html.ActionLink("Details", "Details", new { controllerName = item.Controller })
+            </td>
+        </tr>
+    }
+</table>
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/ActionPermission/Permissions.cshtml b/AspNetIdentity2GroupPermissions/Views/ActionPermission/Permissions.cshtml
new file mode 100644
index 0000000..b52f750
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Views/ActionPermission/Permissions.cshtml
@@ -0,0 +1,48 @@
+@model IdentitySample.Models.ApplicationActionPermission
+
+@{
+    ViewBag.Title = "Permissions";
+}
+
+<h2>Controller Action Permissions</h2>
+
+<p>
+    @Html.ActionLink("Create New", "Create")
+</p>
+<div>
+    <hr />
+    <dl class="dl-horizontal">
+        <dt>
+            @Html.DisplayNameFor(model => model.ControllerName)
+        </dt>
+
+        <dd>
+            @Html.DisplayFor(model => model.ControllerName)
+        </dd>
+
+        <dt>
+            @Html.DisplayNameFor(model => model.ActionName)
+        </dt>
+
+        <dd>
+            @Html.DisplayFor(model => model.ActionName)
+        </dd>
+    </dl>
+</div>
+<h4>List of permissions granted this action</h4>
+
+<table class="table">
+
+    @foreach (var item in ViewBag.RolesList)
+    {
+        <tr>
+            <td>
+                @item
+            </td>
+        </tr>
+    }
+</table>
+<p>
+    @Html.ActionLink("Edit", "Edit", new { id = Model.Id })
+    @Html.ActionLink("Back to List", "Index")
+</p>
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Create.cshtml b/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Create.cshtml
index 863a0e2..20e3af4 100644
--- a/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Create.cshtml
+++ b/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Create.cshtml
@@ -6,11 +6,10 @@
 
 <h2>Create</h2>
 
-
-@using (Html.BeginForm()) 
+@using (Html.BeginForm())
 {
     @Html.AntiForgeryToken()
-    
+
     <div class="form-horizontal">
         <h4>ApplicationGroup</h4>
         <hr />
@@ -23,6 +22,13 @@
             </div>
         </div>
 
+        <div class="form-group">
+            @Html.Label("Admin Group ?", new { @class = "control-label col-md-2" })
+            <div class="col-md-10">
+                @Html.CheckBoxFor(model => model.IsAdmin)
+            </div>
+        </div>
+
         <div class="form-group">
             @Html.LabelFor(model => model.Description, new { @class = "control-label col-md-2" })
             <div class="col-md-10">
@@ -30,6 +36,7 @@
                 @Html.ValidationMessageFor(model => model.Description)
             </div>
         </div>
+
         <div class="form-group">
             <label class="col-md-2 control-label">
                 Select Group Roles
@@ -59,4 +66,4 @@
 
 @section Scripts {
     @Scripts.Render("~/bundles/jqueryval")
-}
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Details.cshtml b/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Details.cshtml
index 95b9fbb..e5abd8a 100644
--- a/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Details.cshtml
+++ b/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Details.cshtml
@@ -8,7 +8,7 @@
 
 <div>
     <h4>ApplicationGroup</h4>
-	<hr />
+    <hr />
     <dl class="dl-horizontal">
         <dt>
             @Html.DisplayNameFor(model => model.Name)
@@ -25,7 +25,13 @@
         <dd>
             @Html.DisplayFor(model => model.Description)
         </dd>
+        <dt>
+            Admin Group
+        </dt>
+        <dd>
 
+            @(Model.IsAdmin ? Html.Raw("Yes") : Html.Raw("No"))
+        </dd>
     </dl>
 </div>
 
@@ -50,4 +56,4 @@
 <p>
     @Html.ActionLink("Edit", "Edit", new { id = Model.Id }) |
     @Html.ActionLink("Back to List", "Index")
-</p>
+</p>
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Edit.cshtml b/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Edit.cshtml
index 9824c44..dd8bc9e 100644
--- a/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Edit.cshtml
+++ b/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Edit.cshtml
@@ -6,11 +6,10 @@
 
 <h2>Edit</h2>
 
-
 @using (Html.BeginForm())
 {
     @Html.AntiForgeryToken()
-    
+
     <div class="form-horizontal">
         <h4>ApplicationGroup</h4>
         <hr />
@@ -32,6 +31,12 @@
                 @Html.ValidationMessageFor(model => model.Description)
             </div>
         </div>
+        <div class="form-group">
+            @Html.Label("Admin Group ?", new { @class = "control-label col-md-2" })
+            <div class="col-md-10">
+                @Html.CheckBoxFor(model => model.IsAdmin)
+            </div>
+        </div>
         <div class="form-group">
             @Html.Label("Permissions", new { @class = "control-label col-md-2" })
             <span class=" col-md-10">
@@ -59,4 +64,4 @@
 
 @section Scripts {
     @Scripts.Render("~/bundles/jqueryval")
-}
+}
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Index.cshtml b/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Index.cshtml
index bf47fd5..0012d61 100644
--- a/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Index.cshtml
+++ b/AspNetIdentity2GroupPermissions/Views/GroupsAdmin/Index.cshtml
@@ -17,23 +17,34 @@
         <th>
             @Html.DisplayNameFor(model => model.Description)
         </th>
-        <th></th>
+        <th>Admin Group</th>
     </tr>
 
-@foreach (var item in Model) {
-    <tr>
-        <td>
-            @Html.DisplayFor(modelItem => item.Name)
-        </td>
-        <td>
-            @Html.DisplayFor(modelItem => item.Description)
-        </td>
-        <td>
-            @Html.ActionLink("Edit", "Edit", new { id=item.Id }) |
-            @Html.ActionLink("Details", "Details", new { id=item.Id }) |
-            @Html.ActionLink("Delete", "Delete", new { id=item.Id })
-        </td>
-    </tr>
-}
+    @foreach (var item in Model)
+    {
+        <tr>
+            <td>
+                @Html.DisplayFor(modelItem => item.Name)
+            </td>
+            <td>
+                @Html.DisplayFor(modelItem => item.Description)
+            </td>
+            <td>
 
-</table>
+                @if (item.IsAdmin)
+                {
+                    @Html.Raw("Yes")
+                }
+                else
+                {
+                    @Html.Raw("No")
+                }
+            </td>
+            <td>
+                @Html.ActionLink("Edit", "Edit", new { id = item.Id }) |
+                @Html.ActionLink("Details", "Details", new { id = item.Id }) |
+                @Html.ActionLink("Delete", "Delete", new { id = item.Id })
+            </td>
+        </tr>
+    }
+</table>
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/Secure/Create.cshtml b/AspNetIdentity2GroupPermissions/Views/Secure/Create.cshtml
new file mode 100644
index 0000000..70f7f33
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Views/Secure/Create.cshtml
@@ -0,0 +1,6 @@
+@{
+    ViewBag.Title = "Create";
+}
+
+<h2>Secure Create</h2>
+<p>Well , you can create</p>
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/Secure/Details.cshtml b/AspNetIdentity2GroupPermissions/Views/Secure/Details.cshtml
new file mode 100644
index 0000000..7455b1a
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Views/Secure/Details.cshtml
@@ -0,0 +1,6 @@
+@{
+    ViewBag.Title = "Details";
+}
+
+<h2>Details</h2>
+<p>Secure details page</p>
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/Secure/Index.cshtml b/AspNetIdentity2GroupPermissions/Views/Secure/Index.cshtml
new file mode 100644
index 0000000..3da673a
--- /dev/null
+++ b/AspNetIdentity2GroupPermissions/Views/Secure/Index.cshtml
@@ -0,0 +1,8 @@
+@{
+    ViewBag.Title = "Index";
+}
+
+<h2>Index</h2>
+<p>If you can see this page then you have permissions</p>
+@Html.ActionLink("Secure Create", "Create")
+@Html.ActionLink("Secure Details", "Details")
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Views/Shared/_Layout.cshtml b/AspNetIdentity2GroupPermissions/Views/Shared/_Layout.cshtml
index 93d758f..e341ffe 100644
--- a/AspNetIdentity2GroupPermissions/Views/Shared/_Layout.cshtml
+++ b/AspNetIdentity2GroupPermissions/Views/Shared/_Layout.cshtml
@@ -6,7 +6,6 @@
     <title>@ViewBag.Title - My ASP.NET Application</title>
     @Styles.Render("~/Content/css")
     @Scripts.Render("~/bundles/modernizr")
-
 </head>
 <body>
     <div class="navbar navbar-inverse navbar-fixed-top">
@@ -25,10 +24,13 @@
                     <li>@Html.ActionLink("About", "About", "Home")</li>
                     <li>@Html.ActionLink("Contact", "Contact", "Home")</li>
 
-                    @if (Request.IsAuthenticated && User.IsInRole("Admin")) {
+                    @if (Request.IsAuthenticated)
+                    {
                         <li>@Html.ActionLink("RolesAdmin", "Index", "RolesAdmin")</li>
                         <li>@Html.ActionLink("UsersAdmin", "Index", "UsersAdmin")</li>
                         <li>@Html.ActionLink("GroupsAdmin", "Index", "GroupsAdmin")</li>
+                        <li>@Html.ActionLink("ActionPermissions", "Index", "ActionPermission")</li>
+                         <li>@Html.ActionLink("Secure", "Index", "Secure")</li> 
                     }
                 </ul>
                 @Html.Partial("_LoginPartial")
@@ -47,4 +49,4 @@
     @Scripts.Render("~/bundles/bootstrap")
     @RenderSection("scripts", required: false)
 </body>
-</html>
+</html>
\ No newline at end of file
diff --git a/AspNetIdentity2GroupPermissions/Web.config b/AspNetIdentity2GroupPermissions/Web.config
index cfe56b3..39be148 100644
--- a/AspNetIdentity2GroupPermissions/Web.config
+++ b/AspNetIdentity2GroupPermissions/Web.config
@@ -42,11 +42,11 @@
       </dependentAssembly>
     </assemblyBinding>
   </runtime>
-<connectionStrings>
-    <add name="DefaultConnection" 
-         connectionString="Data Source=(LocalDb)\v11.0;
-           Initial Catalog=AspNetIdentity2GroupPermissions-5;
-           Integrated Security=SSPI" 
+  <connectionStrings>
+    <add name="DefaultConnection"
+         connectionString="Data Source=(localdb)\MSSQLLocalDB;
+           Initial Catalog=AspNetIdentity2GroupPermissions;
+           Integrated Security=SSPI"
          providerName="System.Data.SqlClient" />
   </connectionStrings>
   <appSettings>
@@ -55,4 +55,5 @@
     <add key="webpages:Enabled" value="false" />
     <add key="ClientValidationEnabled" value="true" />
     <add key="UnobtrusiveJavaScriptEnabled" value="true" />
-  </appSettings></configuration>
\ No newline at end of file
+  </appSettings>
+</configuration>
\ No newline at end of file
diff --git a/README.md b/README.md
index 53fdb7c..6ca9b62 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,8 @@ This project expands upon the work done by the ASP.NET Identity Team in the Iden
 
 In this project, we make extensive addtions to the original Identity Samples project. We start with the easily extensible project template found at [AspNet Identity 2.0 Extensible Project Template](https://github.com/TypecastException/AspNet-Identity-2-Extensible-Project-Template) and add the capability to organize granular Role permissions into Groups, to which Users can then be assigned. 
 
+Update : Added the ability to authorize controller actions based on Roles, check [PermissionFilter] class to see how this works.
+
 There is a lot of room for improvment in this project. Particularly with respect to the design of Views and presentation. Do feel free to add to the issues list and/or hit me with a Pull Request if you have ideas or some code to add. 
 
 For more information on ASP.NET Identity, see: