Adding a tiny bit to Ken's response:
From the Java EE 6 platform spec:
EE.3.3.4 Container Based Security
Security for components is provided by their containers in order to achieve the goals
for security specified above in a Java EE environment.
There might be other places in the spec that address this, but this is one.
[Message sent by forum member 'tjquinn']
http://forums.java.net/jive/thread.jspa?messageID=393766