Welcome to the JavaRanch. Off the top of my head, there are two options:
One, you could have the action the form is submitted to be profile-specific. That would let you keep the validation in the "usual" place: the XML files.
Two, it is also possible to implement
ValidationAware by providing your own validate method (if you use
ActionSupport as your Action's base class, note that it already implements ValidationAware).
Personally, I find it easier to handle logic in code than in configuration files, so I tend to override validate if my requirements are more than simple field checks. Some people may find that confusing if they expect all validation logic to be in the XML files.