If the front controller can serve up any view including HTML and JSON and XML and whatever-based, then the security is handled by the controller which will act as an intermediary to every public interface and your service layer.Now, it is no secret that I am NOT a great architect and OO for me is an uphill battle (Your presentation was quite good by the way - thanks for kicking off cf.Objective()