The service works by returning a "wrapper" around a supplied domain object (using byte buddy), and it is this wrapper that ensures that the hide/disable/validate rules implies by the Apache Causeway programming model are enforced.