1. A method for merging security constraints associated with an application when using security annotations, comprising: during application deployment, generating a list of role names; during application runtime in an application server, retrieving security constraints for the application from a plurality of sources, the sources including dynamic and static security annotations, and a deployment descriptor; and using the list of role names and the security constraints retrieved from the plurality of sources to generate a set of merged security constraints having an order of precedence.