@Stateless public class MySecureBean { @RolesAllowed({"admin", "user"}) public void performSensitiveAction() { } @RolesAllowed("admin") public void performAdminAction() { } }