Declarative security enables the application developer to specify which users are authorized to access which methods of the enterprise beans, and to authenticate these users with basic, or username-password, authentication.
The person who is developing an enterprise application is not the same person who is responsible for deploying the application.