The EJBResource and WebResource represent abstractions for the ejb/web resources that need access control. Rather than use the context map to store the aspects needed for authorization, such as ejbName, ejbMethod, ejbMethodRoles etc, these should be read-write properties of the resource.