Darran, in EJB 3.2, there's a new role "**" which has been introduced with the following semantics:

>> A security role with the name “**” is defined by the Container, and is intended to be used by the Bean Provider, Application Assembler, or Deployer to indicate that the caller must log on or authenticate to invoke a method or to perform some processing requiring membership in this container role. This container security role indicates that authentication, without consideration of role membership, is required. 


Do you think it would make sense to use "**" instead "*" in this case too, for the sake of consistency?