There's no way to enforce security on an in-vm connection

When AS7 starts org.jboss.as.messaging.jms.JMSService sets up a default security override for in-vm connections. There is no way to disable this override and there should be.