I had started to digest the JACC spec and how JBoss implements it a few months back, but have not looked at it recently. So this is pure speculation on what I think I know. The point I was trying to make is that you have been modifying the PolicyContext specified by contextID "kr.jar". That does not mean that it is the same contextID set by container for your component. To be more specific, JBoss creates and configures the Policy at deployment time under a specific contextID. I am not sure what that is. Then your code comes along and tries to modify that context, but are you actually configuring the same context. cgriffith View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3964621#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...