I have a question regarding EJB3.1 security. If I apply @DenyAll at bean class level, and @RolesAllowed("xyz") on a method aMethod in the same class. Will @RolesAllowed applied on method override the @DenyAll applied on the class level, i.e. Will a client in role "xyz" be able to call aMethod??