So, I've done some more digging.
jbpm-5.3.0.Final-installer-full.zip contains the war files for drools-guvnor, designer, jbpm-form-builder etc.
To modify beans.xml to enable drools-guvnor authorisation, requires unjar'ing the drools-guvnor.war.
So I've done that, modified beans.xml as per: http://docs.jboss.org/drools/release/5.4.0.Final/drools-guvnor-docs/html/ch14.html and redeployed the jar.
These are the changes I've made in beans.xml:
<!-- JAAS based authentication -->
<security:authenticatorName>jaasAuthenticator</security:authenticatorName>
<security:jaas.JaasAuthenticator>
<s:modifies/>
<!--
The following one will use the jaas configuration called "other",
which in jboss AS means you can use properties files for users.
-->
<jaasConfigName>other</jaasConfigName>
</security:jaas.JaasAuthenticator>
Now, when I start drools-guvnor I get the following errors:
05:20:50,442 ERROR [org.jboss.as.deployment] (DeploymentScanner-threads - 1) {"Composite operation failed and was rolled back. Steps that failed:" => {"Operation step-2" => {"Failed services" => {"jboss.deployment.unit.\"drools-guvnor.war\".WeldService" => "org.jboss.msc.service.StartException in service jboss.deployment.unit.\"drools-guvnor.war\".WeldService: org.jboss.weld.exceptions.DefinitionException: Exception List with 1 exceptions:
Exception 0 :
java.lang.Exception
at org.jboss.solder.config.xml.bootstrap.XmlConfigExtension.beforeBeanDiscovery(XmlConfigExtension.java:121)