Thanks for the reply.
Yea :/, the work involved in fiddling with the service layer decorator and server-side RF at that level currently outweighs the benefit for my need which is what I was avoiding. I think if I fiddled at that level I might just end up making the .with() work with primitives also. It would be a nice to have as the property resolution already does this for the proxy, I can't see the extension of .with() to include this as being much more complex.
And thanks, an annotation like PreAuthorize is something nice to keep in mind if you're going to go into the decorator. The other way I thought of doing it would be to have 2 different entity proxies for the same entity. That way you could keep and use 2 different property definitions/contracts for the same entity and use the most appropriate one. This would also keep the code cleaner and more cohesive as your functionality can be written around the appropriate contract, at least in my opinion.