This is an article on programatically adding secuity to a BDC entity.
The key point is that there are two API’s for accessing the BDC catalog.
One is read only, the other is slower yet can update.
Developer Rants 