Basically when you deploy your EJB you include a deployment descriptor which states who can access it (ACL based). You can put restrictions on the EJB or on individual methods. The developer writes no security code, the underlying J2EE app server intercepts all calls to the EJB and verifies that they are allowed.