Using NHibernate in a Medium Trust web environment requires the following:

• All referenced assembiles must be marked with AllowPartiallyTrustedCallers
• Web.config configSections must be marked with requirePermission="false"
  <configSections>
    <section name="hibernate-configuration" requirePermission="false" type="NHibernate.Cfg.ConfigurationSectionHandler, NHibernate"/>
    <section name="log4net" requirePermission="false" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" />
    ...
  </configSections>
• Reflection optimization must be disabled
  <hibernate-configuration xmlns="urn:nhibernate-configuration-2.2">
    <reflection-optimizer use="false" />
    ...
  </hibernate-configuration>
• Default lazy loading must be disabled on all class mappings
  <hibernate-mapping xmlns="urn:nhibernate-mapping-2.2" default-lazy="false" assembly="Example.Domain" namespace="Example.Domain.Models">
    <class name="Person">
      ...
    </class>
  </hibernate-mapping>
  Alternativly you could keep lazy loading enabled (the default) and Pre-Generate Lazy Loading Proxies 

Using ActiveRecord in a Medium Trust web environment requires the following:

• All referenced assembiles must be marked with AllowPartiallyTrustedCallers
• Web.config configSections must be marked with requirePermission="false"
  <configSections>
    <section name="activerecord" requirePermission="false" type="Castle.ActiveRecord.Framework.Config.ActiveRecordSectionHandler, Castle.ActiveRecord"/>
    <section name="log4net" requirePermission="false" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" />
    ...
  </configSections>
• Reflection optimization must be disabled
  Place this line after your call to ActiveRecordStarter.Initialize(...):
  NHibernate.Cfg.Environment.UseReflectionOptimizer = false;
  
• Default lazy loading must be disabled on all class mappings
  <activerecord isWeb="true" default-lazy="false">
    <config>
      ...
    </config>
  </activerecord>
  Alternativly you could keep lazy loading enabled (the default) and Pre-Generate Lazy Loading Proxies