When I have defined permissions using security roles in ejb-jar.xml (ejb-spec) for certain methods and if I define them differently in jboss-ejb3.xml (jboss-spec) the permissions remain as their are defined in ejb-jar.xml. But I would expect that ejb-spec will redefine the permissions (because merging is not possible).

For details see written tests here: https://github.com/rhatlapa/jboss-as/commit/62adba59b288a53672a6b08c8a710e3b5208ce10