CacheAccess sounds fine, though it has a feeling of the cache being something external to ORM. I rather think about cache as totally owned component, despite that the implementation uses different project. While you repeat that everything should be expressed from Hibernate side (and I agree to that), Hibernate and Cache does not have a peer relationship.

(2) expresses the contract pretty well, I agree that with this in, there shouldn't me much doubt about the arguments to buildEntityRegionAccess.

Ad cache per region vs. cache per region access: cache per Region has an implementation problem with

@Cache(region="a.b.c",usage=TRANSACTIONAL)
public class Person { ... }

@Cache(region="a.b.c",usage=NONSTRICT_READ_WRITE)
public class Animal  { ... }

and I am a bit afraid of cache per RegionAccess (in that case you couldn't set max cache size for multiple entities together - this is possible). So I would prefer being able to store multiple roles with the same access type in single cache (and being smart about CacheKeysFactory), while having separate caches "a.b.c#TX" and "a.b.c#NSRW".