I am trying to allow all methods on a session (or message) bean to be invoked by anyone. So I added @PermitAll to the class declaration, however this didn't have the desired effect. Only once I started addding this annotion to the individual methods did thing start to work. Is this how it is supposed to be done, or did I miss something. I am using JBoss 7.2 / JBEAP6.1.