title: data 'security' with java and hibernate
body: <p>The system I am currently working on requires some role-based security, which is well catered for in the Java EE stack. The system intends to be a framework for business domain experts to write their code on top of.</p>
  
  <p>However, there is also a requirement for data <code>security</code>. That is, what information is visible to an end user.</p>
  
  <p>This effectively means reducing visibility to rows (and perhaps even columns) in the database.</p>
  
  <p>We are using Hibernate for our persistence. However, we are using our own annotations so as not to expose our persistence choice to the business domain experts. </p>
  
  <p>For row based security this means we could add an annotation such as <code>@Secured</code> at the entity level, which would cause an extra column to be added to the underlying table to constrain our selects?</p>
  
  <p>For column based security, we could perhaps have <code>@Secured</code> to either assist in query generation, or perhaps use an aspect to filter the information returned?</p>
  
  <p>I'm curious to know how this might affect hibernate's caching mechanisms as well?</p>
  
  <p>I'm sure a lot of others will have had the same issue, and I was wondering how you approached this?</p>
  
  <p>Much appreciated...</p>