"alesj" wrote : | both beans get normally installed. | | What am I missing? | They shouldn't be!!!! If your the test deploys the xml manually, it should throw a SecurityException. It doesn't have the authority to access though fields, so it shouldn't gain the authority via deploying xml file. If the xml is deployed during the bootstrap then it runs under the MC's ALL authority and would allow it. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4137807#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...