"ron.sigal(a)jboss.com" wrote : | I was thinking more in terms of declarative injection by way of *-beans.xml files. I'm not sure I see how an application level bean would get access to Remoting ... . Actually, that raises a question I've been meaning to figure out: What is the microcontainter/POJO analog to grabbing an MBeanServer and accessing an MBean by way of its object name? | There is a KernelRegistryPlugin that allows for accessing info about a bean, but typically this is done by injection using the name. "ron.sigal(a)jboss.com" wrote : | I'm missing something. If "application framework code" means the Application Server, then these statements sound contradictory ... . Also, is there a way for a Connector method to check that it's being called by JBoss code? | Yes, application framework code here are the server containers and application metadata. An application wanting remote class loading would include a -jboss-beans.xml that wires the deployment class loader to the remoting connector. There is also a jboss-classload*.xml that could be used to define the class loader bean name so its known. Maybe there is a pattern such that its not necessary to use jboss-classload*.xml for this. The Connector would simply have a permission check. The permission would be mapped to jboss code by the permission CodeSource. Whoever sets up the security policy effectively defines jboss/server code from application code based on the permission urls. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4169446#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...