See also the EJB 3.2 spec, "4.9.6 Business Methods":

The session bean class may define zero or more business methods whose signatures must follow these rules:

• ...
• The method must be declared as public.
• ...