I did not create the annotation. I also did not refactor them or move them. I have just taken the task of cleaning up the ejb3 security integration for AS5. Given this, I feel for AS5, the annotation should be in the security spi project. I do not handle ejb3 stuff for Branch_4_2. That is where the issues for you exist. This is where Carlo/BillD/Scott should opine. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4138690#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...