When using the

<run-as>
<role>internal</role>
</run-as>

(provided that the internal is a role that cannot be grated to external clients)

via a session bean to access an entity bean with audit fields set, then the updatedBy and
createdBy fields are populated as "anonymous" instead of the logged user.