I have made some signifigant progress on the ACL security in CHT.  At this point the security is implemented using the visible and enabled proeperties of the controls on the form.  I have wrapped the label, input (textbox, etc) validators and help controls in a an asp:panel (which renders to a div) so that I can simlply hide the whole thing if the user does not have view rights to the object.  For the edit rights I simply disable the input if they do not have edit rights.

At the collection level there are add and delete permissions.  These are pretty easy to establish a link for add and delete just needs to be hidden/visible based on permissions.

An additional issue will be the view permissions in the collection (list) view of the objects.  This could either be handled with templates or with the same visible = true|false scheme. 

So far, so good...