We can define security domain in the subsystem but like I said, ideally in the subsystem we will strive to have only the "other" defined. Applications would deploy something like security-domain.xml where the particular security domain is defined. For example if were to have a jmx-console.war it would deploy its own security domain (perhaps in the root folder or WEB-INF) along with the jmx-console-users.properties and jmx-console-roles.properties in the WEB-INF/classes directory.