We should move the SubjectCreatingPolicyInterceptor to PRE_PROTOCOL interceptor phase. That would make it to run before the HandlerAuthInterceptor, hence allowing WS-Security based authentication before handlers auth check and execution.