how do you implement any sort of nontrivial authorization scheme w/out middle tier? how can you share any code between different UI platforms? I also don't like

how do you implement any sort of nontrivial authorization scheme w/out middle tier? how can you share any code between different UI platforms? I also don't like exposing data layer directly to the client. *or worse yet storing business logic in the data layer