You need to assert your UserRole object into the working memory for your permission check. You are calling hasPermission like this: identity.hasPermission("user", "create", "false") The third parameter is a varargs which can accept any number of objects that are asserted into the working memory, so instead you should be passing in the UserRole object: identity.hasPermission("user", "create", r) View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4026596#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...