When WildFly Elytron was integrated with the EJB subsystem we deliberately restricted it to one security domain per deployment, primarily this was due to an issue associating the Elytron SecurityDomain with the deployments ClassLoader.

If instead we found an alternative strategy for association such as per request association so SecurityDomain.getCurrent() continues to work we could likely relax the one security domain per deployment and allow bean specific security domain association.