An other way to separate security concern from business logic in java is to use AOP tools (like AspectJ), or frameworks that provide a similar functionality (like Spring's Interceptor). TODO: some example.
