When you run the QS Tool Maven plugin against this quickstart, it still reports the use of private APIs.

src/main/java/org/jboss/as/quickstarts/ejb_security_interceptors/OuterUserCredential.java:
Import from private API detected - org.jboss.as.core.security.api.UserPrincipal.

src/main/java/org/jboss/as/quickstarts/ejb_security_interceptors/SecurityActions.java:
Import from private API detected - org.jboss.as.security.api.ConnectionSecurityContext.
Import from private API detected - org.jboss.as.security.api.ContextStateCache.

src/main/java/org/jboss/as/quickstarts/ejb_security_interceptors/ServerSecurityInterceptor.java:
Import from private API detected - org.jboss.as.core.security.api.UserPrincipal.
Import from private API detected - org.jboss.as.security.api.ContextStateCache.