With container-managed transaction demarcation , the EJB container handles transaction management. This greatly simplifies an Application Component Provider's responsibilities and tasks, especially for transactions in distributed environments. However, a bean cannot use both types of transaction at the same time. The Application Component Provider decides the type of transaction demarcation that a session bean will use and must declare the transaction style via attributes in the enterprise bean's deployment descriptor. The attributes indicate whether the bean or container will manage the bean's transactions and, if the latter, how the container will manage the transactions.
Entity beans can only use container-managed transaction demarcation.
The J2EE platform security services are designed to ensure that resources are accessed only by users authorized to use them. An entity that can be authenticated is called a principal . A principal can be a user or another program. Users are typically authenticated by logging in. When an authenticated principal tries to access a resource, the system determines whether the principal is authorized to do so based on the security policies in force in the application's security policy domain .