Mutable="false" will just ensure that Hibernate won't persist any changes to the object...never a bad idea, just in case you use bytecode instrumentation or some other framework bypasses the scopes. If you want to make your setters private, Hibernate won't care, it will still be able to set the properties. That way no other process can change the field values.
The manual wrote:
The no-argument constructor is a requirement for all persistent classes; Hibernate has to create objects for you,
using Java Reflection. The constructor can be private, however, package visibility is required for runtime proxy
generation and efficient data retrieval without bytecode instrumentation.
And
The manual wrote:
Properties need not be declared public - Hibernate can persist a property with a default, protected or private
get / set pair.
And
The manual wrote:
You can see that Hibernate can access public, private, and protected accessor methods, as well as
(public, private, protected) fields directly. The choice is up to you and you can match it to fit your application
design.