jboss-as-datasources_1_0.xsd contains an element for configuring security for recovering datasources. I added this to standalone.xml:

<recovery>
<recover-credential>
<user-name>sa</user-name>
<password>sa</password>
</recovery-credential>
</recovery>

but the AS rewrites this section as follows:

<recovery>
<recover-credential>
<recover-credential>
sa
</recover-credential>
<recover-credential>
sa
</recover-credential>
</recover-credential>
</recovery>