In Part 2 of ASP.NET Security in a Sandbox, Michele Leroux Bustamante shows how to further improve on ASP.NET security using impersonation with Enterprise Services. Those Enterprise Service components can then be activated in their own AppDomain with the execution identity set to a limited access account.