TBH, I was not aware of any JACC policy provider for EJB3 being installed as default. I do not support the default installation of any JACC policy providers in EJB3. We really should be considering a policy provider (DelegatingPolicy) in one central location (such as the legacy conf/jboss-service.xml). By default, this can be commented out. Any independent installation of JACC policy is invitation to subtle issues like this. What do you think, Scott? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4113105#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...