"...but front end COTS clients (WEB browsers, etc) don't have standard ways to do that".

Actually, we offer a scalable multi-level security solution that works with an existing mixed platform environment and deals very well with the issues you mention.

The ability to have control over your business data flow allows the set up of trust zones within the environment that will not allow data to be released to a user, unless access privilege exists, no matter what device is used, (since a white list approach is used), but still allows mobile devices to be used with regular data, if the policies allow it. It will also allow users to have different levels of privilege in different user groups.

It is usually more advantagious to be able to setup and enforce things like separation of duties and roles, least privilege, etc., based on the business rules (information-centricity) rather than on infrastructure.