We are working on a web application and late in the game someone has
decided that they want certain artifacts (buttons, text fields, etc) to
be accessable based on the user's assigned role. Someone has suggested
using JAAS. However, after looking into it I do not believe this would be
the best route considering that JAAS denies access via an exception.
Exceptions should only be used for exceptional, unexpected conditions and
having each page throw a handful of exceptions would be a burden on the
system.

Now, I could endorse using JAAS in conjungtion with another API that the
JSP can take advantage of via logic tags and wrap the context sensitive
artifacts. That way, I should only have security exceptions if someone is
attempting to hack a page or if the JSP is wrong.

Any rules of thumb?