EE 6.2.2.6 Permission declarations must be stored in META-INF/permissions.xml file

within an EJB, web, or application client archive in order for them to be located
and subsequently processed by the deployment machinery of the Java EE Product.
The permissions for a library are the same as the permissions for the code that
EE.6.2.2.6.2 Permission Declaration Example
<?xml version="1.0" encoding="UTF-8"?>
<permissions>
<permission>
<classname>java.io.FilePermission</classname>
<name>/tmp/abc</name>
<actions>read,write</actions>
</permission>
<permission>
<classname>java.lang.RuntimePermission</classname>
<name>createClassLoader</name>
</permission>
</permissions>

The EE7 spec draft has a schema for permissions.xml