...roles The following technique is supported by all JACC compatible containers given that they are configured with a typicalPolicy provider capable of returning a PermissionCollection encapsulating all the WebRoleRefPermission and/or EJBRoleRefPermission...
http://blogs.sun.com/monzillo/entry/using_jacc_to_determine_a