My approach is basically along the lines of #2. However, taking it a
step further, my rule is essentially to remove all operational code
from data objects completely. So, no 'save()' methods, etc on the
actual object. Instead, you would call a 'save( myObject )' method on
the service instead. That way, you can easily share the data objects
on both server and client, and all business logic sits on the server
side.
David