Both ejb3 and aspects/aop have duplicate implementations of JBossSX security constructs that should belong to that project rather than replicated elsewhere. I need to review these and move them into the security project where approriate.