I manage a pretty massive intranet system that currently uses session state to hold the majority of a user's permissions, group access lists, preferences, etc. In the beginning, that approach worked fine, but now, we are reaching the point where the tax on server memory is affecting performance...