The Bean Provider should NOT implement security mechanisms and
should NOT hard-code security policies in the EJB business methods.
The Bean
Provider should let the Application Assembler and Deployer define the appropriate
security policies for the application. The Deployer, not the Bean Provider,
is responsible for assigning the security domain and principal realm of the
application.