We use AOP at my job for an ASP.NET project (disclaimer: I introduced itt) and it works well for our purposes. We have custom authentication/authorization mechanism and AOP fits the need well. The base class of controllers are annotated with decorators and these rules filter down to all derived classes and action methods. These rules can be overridden at the method level by applying an alternate annotation that overrides the inherited one. This combined with automatic model binding allows us to automatically check access to any resource without performing explicit checks in every method. Security by default is a huge win.