I've tried to apply wiki document http://community.jboss.org/wiki/AccessControlForJMXConsole
but it produces exception during startup because of order of elements in jmx-console.war\WEB-INF\web.xml:

<filter>
<filter-name>JmxOpsAccessControlFilter</filter-name>
<filter-class>org.jboss.jmx.adaptor.html.JMXOpsAccessControlFilter</filter-class>
<init-param>
<param-name>updateAttributes</param-name>
<param-value>UpdateAttributeRole</param-value>
<description>Comma-delimited Roles that define the JMX Operation denoting updation of Attributes</description>
</init-param>
<init-param>
<param-name>invokeOp</param-name>
<param-value>InvokeOpRole</param-value>
<description>Comma-delimited Roles that define the JMX Operation denoting updation of Attributes</description>
</init-param>
</filter>
<filter-mapping>
<filter-name>JmxOpsAccessControlFilter</filter-name>
<servlet-name>HtmlAdaptor</servlet-name>
</filter-mapping>

but in accordance with javaee_5.xsd schema element description should be the first element of init-param:
...
<init-param>
<description>Comma-delimited Roles that define the JMX Operation denoting updation of Attributes</description>
<param-name>updateAttributes</param-name>
<param-value>UpdateAttributeRole</param-value>
</init-param>
<init-param>
<description>Comma-delimited Roles that define the JMX Operation denoting updation of Attributes</description>
<param-name>invokeOp</param-name>
<param-value>InvokeOpRole</param-value>
</init-param>
...

org.jboss.xb.binding.JBossXBException: Failed to parse source: cvc-complex-type.2.4.d: Invalid content was found starting with element 'description'.