If an EJB implements the TimedObject interface and defines a RunAsIdentity, then in the ejbTimeOut method, the bean can access other secured JavaEE components, in which case the configured RAI should kick in.

Push the configured rai on the security context.