For AS5, we introduced a SubjectFactory interface for use by JCA. An issue that is my fault is that the implementation of this interface was done in the security branch of the AS workspace (http://anonsvn.jboss.org/repos/jbossas/branches/Branch_5_0/security/src/main/org/jboss/security/integration/JBossSecuritySubjectFactory.java) rather than the external security project. I do not remember why I placed the implementation in the AS workspace.
For AS7, we need to provide the subject factory implementation inside the PicketBox project. We need to make it a security implementation and remove any JBoss Mgmt API, MC dependencies.