It seems @RunAs allows the flexibility that I require.
Calling Ejb is annotated with the role required for called Ejb. When the protected method is invoked on called Ejb it is invoked with the role specified in annotation.
[Message sent by forum member 'drfranknfurter' (drfranknfurter)]
http://forums.java.net/jive/thread.jspa?messageID=332876