Is there a way to intercept a hibernate call immediately before the actual SQL is executed? Possibly allowing you to alter the SQL?

This would give you the power to do a blanket addition of security constraints to the where clauses of queries that are executed, amongst other things as well.