Security - V
Security roles are defined in the deployment descriptor and the deployer actually maps the principal or principal groups to those roles.
Bean provider declares the security roles with security-role-ref elements in the deployment descriptor.