There are multiple possibilities how to define security domain and how to say which way to use => some defaults might be possible to be defined as defaults in subsystems and also they can be defined in jboss descriptors or via annotations. All possibilities and what takes precedence when should be documented.

Lots of discussion on this topic can be found in [EAP7-465].