I can tell you how JON does it. The security model is wrapped around the abstract management model (in other words, JON relies on its own security mechanism, as opposed to relying on JBossAS security to do things like prohibit invoking operations or configuring things - this is how JON allows for the same security model to secure all types of managed resources in a generic way).

http://rhq-project.org/display/JOPR2/Security+Model

That link shows the different times of security permissions you can get. So, its possible you can view a resource but you can't do things like configure it or run operations on it. But again, this is at a layer above JBossAS (its at the management platform layer).

I'm not sure if this is helpful, but that's what it is wrt JON.

From the profileservice side we don't provide any further options to configure security. It is something to think about adding, but it's more on the long term roadmap. For now management-clients would have to provide this additional security.

The link you posted about remote access to ProfileService seems to be out of date. I need to validate that, but AFAIK you don't need to specify the SecureProfileService anymore. Security can be enabled with some server side settings using the same references - i'll update that. Thanks!