You can turn logging on. To do this, in the admin console (assuming a non-clustered environment). In the menu on the left side click "Application Server". Then there will be a logging tab. Click that. Then a "Log levels" subtab should show up. Click that, navigate down to the Security section and choose "FINE" or greater.
This will show you what roles are being evaluated by the policy manager.
[Message sent by forum member 'athrawn17' (athrawn17)]
http://forums.java.net/jive/thread.jspa?messageID=259523