https://github.com/droolsjbpm/uberfire/tree/master/uberfire-security According to Mark Proctor, this is stop gap work until PL3. Idea is to have the same api for the browser and server for GWT apps. I need to check this tree in detail tomorrow. Another candidate for integration (Uberfire)