Deployer maps the principals or group of principals to the defined security roles. |
The deployer tool defines the principal for inter-bean calls and resource manager access. |
At runtime, each client is associated with a principal. If the client's principal role has a permission to invoke method, then it can be invoked otherwise the request will be denied. |
Container is responsible for enforcing the security restrictions at runtime. |