If I read you correctly and I could be misunderstanding you, you are saying that I should compute rather than store the valid moves. Unfortunetly, you end up spending much more time computing the valid move list for each position than doing a look up then searching down the lists for an invalid move or capture. Since it is almost a linear search, it is much faster. On this topic, I recommend reading this article on chess programming over at Gamedev. According to him, sophisticated chess programs generate a few moves at a time then search those (usually trying captures first). I would rather pre-process then do code to add the special cases.
About access control, I was thinking that after I was done filtering the moves so I only had the valid moves and captures, I would just use a copy of the list rather than giving out the referenced array. It does not matter so much in any case since I am the only coder and if anyone else wants to help, I would be able to trust them in the first place. Access control is really all about trust in the end.
Thanks for the thoughts!