Access constraints by themselves didn't do anything for me, but adding the sun-ejb-jar.xml with io-security-config settings did the the trick and everything now behaves as expected.
Thank you, monzillo!
The documentation on these aspects of GS configuration seems to be incredibly hard to find/google, and I've spent 3+ days just trying to get the AS to refuse an unknown client access to my ejb module. I guess I'm a bit disappointed at the amount of time I've had to spend researching something so basic.
Even now that I have the fix, I still can't find any decent web-documentation on this. googling sun-ejb-jar.xml brings up nothing really useful (from a learner's standpoint). The sun documents (
http://docs.sun.com/app/docs/doc/819-3660/beaqi?a=browse) are hilariously unusable.
[Message sent by forum member 'rycohen2000' (rycohen2000)]
http://forums.java.net/jive/thread.jspa?messageID=271075