http://docs.oracle.com/javaee/6/api/javax/annotation/security/RolesAllowed.html
It basically defines the roles that a particular method can access. So your intent is correct.
We may have a bug. Can you ensure that something like @RolesAllowed("BAD") fails?