I've seen your post on castle forum and I'm not satisfied with the answer you've got. There was also another post regarding this issue, but the answer was even less informative.

I'm affraid no one can help us and without support from hoster we are not able to use any of template based generators (which have to use reflection and probably compiler services to interpret & execute the template).

Actually I think medium trust should be mandatory in shared environments. This is a great work done by MS on security and isolates our app from others. Even when admin would not secure the server using proper ACLs on ntfs drives/registry/other system objects, we and other users are probably safe because of the CAS restrictions. Few days ago I found a small ( < 1000 accounts) hosted site where without any account I was able to modify any user file found on that server. There was one domain user for all web accounts, no acls, full trust and few open accounts with opportunity to upload my own piece of code - totally anonymously. I've put a 'greeting' file on admin test account and - of course - informed the admin of some problems in security. Actually I was considering establishing basic account on this site, because it was promoted by ... and I was sure there must have been everythig ok. The moral of this story is - be aware of full trust, because your neighbour may be interested in your data, and without proper settings from hoster you cannot do anything to protect yourself.

Probably you are working in a higher trust level. MSDN Library states clearly (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/thcmch09.asp):

Full: Unrestricted permissions. Applications can access any resource that is subject to operating system security. All privileged operations are supported.

High: Not able to call unmanaged code. Not able to call serviced components. Not able to write to the event log. Not able to access Microsoft Message Queuing queues. Not able to access OLE DB data sources...

Medium: In addition to the above, file access is restricted to the current application directory and registry access is not permitted.

No reflection permissions whatsoever. No sockets permission. Can send e-mail by using SMTP servers.

To check what trust level you are operating in simply use the IsGranted method described in my previous post, against for example RegistryPermission or mentioned ReflectionPermission.