I have committed code to Grails to support a declarative syntax for imposing restrictions on which controller actions may be invoked using which http request methods. See the docs for details.