How should I retrieve the logged in User from session and pass it to my Business Layer?
===

I use JSF, Hibernate and CDI with Weld. My application is divided in: View (xhtml), Control (Request/Session/View scoped Beans), Model (Entities) and Business (BO's marked as Application scoped beans).

I try to keep Model and Business layers decoupled from View and Control as much as possible, meaning that if want to change all of the xhtmls + control beans, it's possible without affecting Business Layer and Entities.

My problem is: There are a lot of methods in the Business Layer that need to know who is the logged user (or at least his Profile), because that will affect the results that are going to be returned back to the control layer. 

E.g.: When requesting a list of Users to edit, an Administrator would receive a list with all registered users, and a Manager would receive a list with only the users that are "below" his profile.

I don't want to inject my Session Bean (containing the logged user) into my Business Layer, because that would cause coupling (meaning that I wouldn't be able to just change my Control/View layer at any time).

Nowadays I do this by passing the logged user as a parameter of my BO's methods, but to me that "feels" wrong. I keep thinking that the Control layer can just pass whoever it wants as the logged user, and my Business layer would never know about it.

My final questions are:

1. Is there anything wrong with the way I'm doing it? Or am I over thinking too much?
2. Is there a better way to do it?