What are your thoughts regarding providing this kind of logic in a complex Permission setter method (i.e. permission.set(id, confId, givenById, time) ? I'm not sure of best practice for POJO like Java object, but it centralizes it where it's needed, and in this case eliminates the need for an abstract PermissionProcess parent object.