Turning On SecurityManager only enforces additional policy checks likes the one you mentioned. You will have to actually have your annotations to protect the access to your bean.
[Message sent by forum member 'kumarjayanti' (kumarjayanti)]
http://forums.java.net/jive/thread.jspa?messageID=271007