"wolfc" wrote : As for the order: at one point we must have a full set of meta data attached for use in the SecurityDeployer & WebServices. | Either we do parse & scan = complete or scan & parse = complete. Since xml overrides annotations my vote is for: scan then parse. Actually, xml overrides annotations because they are different things! :-) Class level metadata == annotations Instance level metadata == xml (or predetermined attachments) Instance (the Object level) overrides Class (shared across objects). The order of populating does not matter if you get this basic fact correct. See the hierarchical metadata stuff in the jboss-container project which is also available in aop. This is how we allow instance level annotation overrides in the microcontainer. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4059556#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...