The authorization layer may be configured with jacc authorization module. Hence the ejb3 layer needs to ensure that the policy context jacc id is set.