The EJB3 container will apply those security restrictions based on it's security model. I believe Seam security does add roles to the JAAS subject, so I'd imagine those annotations would work with Seam-managed security on JBoss. I doubt it would work on other appservers, since security implementation is not standardized across servers. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4096612#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...