I am just brain storming out loud here...
I think that you can achieve this my first doing validation, using whatever method you like to use. Then perhaps a session or an entity bean that can check privilege of the user. Based on the privilege, you can instantiate different session or entity beans ( sessions if you have time to implement a full session-entity facade pattern). Have different database pools, for example, privilege pool with 50 connections and commoner pool with 50 connections. Have your different entities beans access the db using the different pools. Therefore if I am a privileged user, I would have the privileged version of getAccountBalance session bean instantiated, which accesses the privilege version of the Account entity bean which accesses the privileged db connection pool. Considering that there would be a smaller number of privileged user sharing a connection pool of same size as common user. A privilege user would have much faster access to data. Aside from just playing with db connection number, you can also, play with the ratio of cached ejbs for the 2 different classes. I think this should work... of course, you can also look at request forwarding and load balance off 2 web servers, but that is just boring.
Dix