i moved the role who may bypass the security to the voters. the plus is that places that need to know if the user is allowed to see things do not need to know about such rules (and i.e. a state + role based workflow logic could be implemented just as easy).

the drawback is that we have no way of chosing whether we want to have the bypass role in action or not. one thing we could do is define a second attribute that is used in this situation, as VIEW_PUBLIC or something, to indicate the check must be done even if the user is granted the bypass-role.