Since I posteded a reference to a forum post I've done more investigating, and feel this is worth mentioning. The ASP.NET 2.0 site map framework uses, by default, and XML file to define the menu structure, as a set of XML nodes. Each of these can have a 'roles' attribute, allowing a command delimited list of roles, to which that menu item applies; that is, the menu item shouldn't be shown to people not in any of the roles.

I myself fell into the trap of thinking this doesn't work, and confusion comes from two areas. First you have to explicitly enable the provider to allow this to work, by setting the securityTrimmingEnabled attribute to true (this means either modifying machine.config, or adding a new provider to web.config; you can simply copy the provider from machine.config and rename it, adding the new attribute in the process). Secondly you need to understand that what defines whether the node is shown is a combination of the roles that the user is in and the authorization as configured in web.config. Actually there's a third part, which is file permissions, but for most people that's not relevant. The default site map provider examines the users' role, checks the <authorization> section of the configuration and checks the file permissions before deciding if the menu item should be shown.

So, enabling security trimming and settings the roles in the site map nodes isn't all you have to do. By default the authorization is allow all (allow users="*"), so irrespective of your role you'll see menu items. This means you need to explicitly deny access to resources, and then allow them per role. For example, consider a fairly standard situation, where files at the top level are allowed for all users, but files under the admin directory are not (an in fact are restricted by the role). You want a single menu, so items for administration should only be shown to authorised users. The site map file could be:

<siteMap>
  <siteMapNode title="Home" url="Default.aspx">
    <siteMapNode title="Some Page" url="SomePage.aspx" />
    <siteMapNode title="Admin" url="Admin/Admin.aspx" 
          roles="Administrator,PowerUser">
      <siteMapNode title="Site Admin" url="SiteAdmin.aspx"
            roles="Administrator" />
      <siteMapNode title="User Admin" url="Admin/UserAdmin.aspx" 
            roles="PowerUser" />
    </siteMapNode>
  </siteMapNode>
</siteMap>

Here the Admin menu only appears for users in the Administrator or PowerUser roles, and menu items are further restricted. Apart from setting the authentication mode and adding the securityTrimmingEnabled attribute to the provider, nothing needs adding to the root web.config. You do however, need a web.config in the Admin directory, which would contain:

<configuration>
  <system.web>
    <authorization>
      <deny users="*" />
    </authorization>
  </system.web>
  <location path="SiteAdmin.aspx">
    <system.web>
      <authorization>
       <allow roles="Administrator" />
    </authorization
    </system.web>
  </location>
  <location path="UserAdmin.aspx" >
    <system.web>
      <authorization>
        <allow roles="PowerUser" />
      </authorization>
    </system.web>
  </location>
<configuration>

Here all users are denied access to all files, but then individual files lift the restriction based upon the role. People in the Administrator role will only see the SiteAdmin item, while Power Users will only see UserAdmin. It's the combination of this config file and the site map nodes that ensure that the menu item gets shown; a combination which is extremely powerful and provides a simple way to restrict file and menu access.