Hibernate version: any recent (2.1.*, 3.0)

We are developing a access control system to protect data that are only available to certain kinds of use and certain user groups.

We are considering doing the access control as a "proxy interface" to hibernate. The proxy should perform some realtime, highly context-dependent access control (among other things). In order to do so, we need to wrap all the methods that can be used to retrieve entity objects from hibernate.

Is it only the Session and Query objects that can return entity objects or are there other ways to obtain the database contents (through hibernate) aswell?

Criteria

...and please take a look at Interceptor also for a possible help of accomplish your task.