How to manipulate authorization at runtime?

Question

Dear JDeveloper's gurus :D
I want to implement an authorization system in my application...for example a certain user (the security administrator) can do the following:
1- Grant access to a certain page.
2- Grant Insert, Update, Delete on a certain ADFBC.
Some of you might say that this can be done declaratively at design time. But my problem is that I want this to be done at runtime, in other words: The security administrator logs in to my application, goes to some pages, in these pages he can choose to grant some privileges (like the ones that were mentioned) to some users/roles.
I know that all security constraints are written in jazn-data.xml, is there like an API to access that file at runtime and edit it?
Maybe that's not a good approach, maybe I can store the users and their privileges in some database tables, and at runtime (maybe in the pagePhaseListener) check whether the logged in user has the privilege to access that page.
Sorry if I sound vague, but what I'm trying to do is the following: I don't want every time I need to grant access to some page definition to a user to open JDeveloper, edit that privilege declaratively and then redeploy the application. I want some pages (made by me) to do that at runtime (I mean giving the privilege without requiring to access JDeveloper and redeploying the application).
Thank you in advance for reading this thread and replying.

Answer 1

Thank you guys for your replies,
I think I will go the easy way...I'm gonna implement a servlet filter and map it to the faces servlet, in the filter I will add my authentication/authorization logic. As for buttons, links, and menus I will add the logic in a managed bean and call the authorization in the UI component's Rendered attribute.