Currently, the business objects are not responsible for all the business rules. Some of these rules are in the serviceimpl's, because those get releases and other items. The business rules should also consider the possibility that some items cannot be found and this needs to be consistent across different interfaces (when SOAP is added for example).
Ideally, create a new business object that was received from the web layer and the key to find the existing one. The BO should then mix and match and ensure it's all there. The business objects should not be manipulated in the serviceimpl layer, but it should add parameters so that the business object can resolve it by itself.
