Just had a blog post cross-posted:

In the JBoss SOA Platform blog:

http://jboss-soa-p.blogspot.com/2010/09/asserting-security-jbossesb-integration.html

And at DZone:

http://java.dzone.com/articles/asserting-security-jbossesb