title: Java – efficient, database-aware instance-level authorization?
body: <p>In a JPA app I have a scenario in which the app is to </p>
  
  <blockquote>
    <p>list all accounts the given user is authorized to withdraw from</p>
  </blockquote>
  
  <p>I have the Account entity and a many-to-many table that lists what authorizations each user has on each account – to implement the above scenario, the app currently just inner-joins the two tables – which is quite quick.</p>
  
  <p>Now, I was planning to add an explicit authorization layer (based on apache shiro / spring security / other) to insulate authorization-related logic from the rest of the code, but...</p>
  
  <p>There are some 10k Accounts in the database and the "average" user is granted "deposit" on all of them, "view" on one half of them and "withraw" on just a few.</p>
  
  <p>Does any security framework allow to implement this scenario efficiently?</p>
  
  <p>Ie: is any of them able to "decorate" a  JPA query of the type "select a from Account a" (or the equivalent SQL) and thus get the list of accounts <em>without loading all user grants from the database</em>, and by all means, <em>without having to retrieve all accounts</em>?)</p>