(1) A collection of methods used by applications when declarative security is not sufficient to express the security model of the application.
(2) Security model using Java enterprise-bean client applications that require the user to provide identifying information. The application must collect that information and authenticate the user.