<assembly-descriptor>
   <security-role>
      <role-name>user</role-name>
   </security-role>
   <security-role>
      <role-name>admin</role-name>
   </security-role>

   <method-permission>
      <role-name>admin</role-name>
      <method>
         <ejb-name>Bid</ejb-name>
         <method-name>remove</method-name>
      </method>
   </method-permission>

   ...
</assembly-descriptor>