Deployment roles can be configured in any of the JBoss DD (jboss-app.xml,jboss.xml and jboss-web.xml). The ejb21,ejb3 and web layer metamodels all are aware of this.

The role mapping provider can pick these role map and map the roles such that the authorization decision can be based on the deployment roles.