Role Based Security lets you identify groups of users to 
allow or deny based on their role in the organization.In 
Windows NT and Windows XP, roles map to names used to 
identify user groups. 

Windows defines several built-in groups, including 
Administrators, Users, and Guests.To allow or deny access 
to certain groups of users, add the <ROLES>element to the 
authorization list in your Web application's Web.config 
file.e.g.

<AUTHORIZATION>< authorization >
   < allow roles="Domain Name\Administrators" / >   < !-- 
Allow Administrators in domain. -- >
   < deny users="*"  / >                            < !-- 
Deny anyone else. -- >
< /authorization >