I am using the WorkFlowServiceHost(in .net 3.5) to host a State Machine Workflow. I use the WCF receive activities to handle calls into the workflow. I am using a WCF authorization policy to attach claims to the incoming requests based on info in the message headers. So, further down the chain I can use the ServiceSecurityContext or just the Thread.CurrentPrincipal to get authorization info about the request(roles, user, etc).I am using the WorkFlowServiceHost(in .net 3.5)