1 | Deployer maps the principals or group of principals to the defined security roles. |
2 | The deployer tool defines the principal for inter-bean calls and resource manager access. |
3 | At runtime, each client is associated with a principal. If the client's principal role has a permission to invoke method, then it can be invoked otherwise the request will be denied. |
4 | Container is responsible for enforcing the security restrictions at runtime. |