Factored out so we can substitute other implementations here if desired, such as the one in ActiveRBAC.
[Validate]