I need to build a system with users and roles, where users and roles have different access to instances of the same object

e.g. user1 can delete "document1" but not delete "document2"

I need to be able to change the permissions programmically.

The objects will be persisted in a RDMS via CMP.

What existing software could I use to do this ? Can I use Jboss with some permissions store to do this ???

Thanks WG