I'd probably end up writing custom mini-framework, leveraging annotations & JAAS + portal/web-wide post-processing filter, hiding inaccessible fields & restricting transmitted POST data.
I already did something similar and it worked (still works) quite okay, however not in Java.
Downside of this approach is certain level of magic, you should document these parts in detail, since it can cause serious confusion in future.
This also probably highly depends on your skills. I'm not aware of any existing framework you could just include and make that problem magiacally disappear, sorry.
I'd also start up building this custom solution around existing Java EE features: http://docs.oracle.com/javaee/5/tutorial/doc/bncav.html
(Just in case you already havent heard about these yet)