I partitioned out the JACC layer into the server module under org.jboss.deployment.JaccInitializationDeployer org.jboss.deployment.JaccCommitDeployer It feels almost a little hacky, why? The JaccInitializationDeployer takes a set a set of attachment names. If the deploymentContext contains that transient attachment, then it will add PolicyConfiguration. The idea being that you can trigger JACC based on whether or not a given DU is a certain type of deployment (is it an EAR WAR or EJB JAR?) View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3977377#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...