There is a need for immediate alignment of the EJB3 security layer with ejb2 security. There may be a need for some abstraction to be pulled out in the JBoss Security SPI/Implementation layer.