Current entity permission control is done by calling the SetEntitySetPermissions like:
Module.SetEntitySetPermissions('*', EntitySetPermissionsRead);
Maybe it would be nice to allow for annotation on the Entity:
type
[Entity]
[AllowMethod('GET', 'POST', 'DELETE')]
MyEntity = class
// ....
end;