The EnterpriseContext.isCallerInRole currently has logic for regular role-ref checks plus added logic to do JACC based checks via a flag on the container as to whether JACC is enabled.

This can be unified to use the Authorization Framework with pluggable authorization modules.