JACC Subject question

[Jeremy Boynes]

JACC defines a Policy Context Handler that returns the actual instance 
being invoked; this would allow a policy provider to invoke methods on 
the target instance directly. If this happens, what operations, if any, 
should the EJB be allowed to do?

For example, can it:
* look up something in JNDI?
* access a resource?
* invoke another EJB?
* for CMP, read a CMP field?
Also, what identity should be used for the invocation - the caller's, 
the container's, or the run-as identity (if defined)?

Anyone know?
--
Jeremy