It *might* be that you can omit the security check and let entityManager do it for you.