I have a custom login module that works correctly when logging in to the app through the web interface and most of my EJB's. I have an EJB that has a One-to-Many relationship with another bean. When a new Bean A entity is created, many Bean B entities are created in the ejbPostCreate method of Bean A. However, when the Bean B entities are being created, JBoss is trying to find a BYPASSED-SECURITY application security policy. For some reason, it is not trying to find my custom application policy. This has only occurred in the situation I have described thus far. If I create a BYPASSED-SECURITY policy in my login-config.xml that is identical to my custom policy, then everything works. Does anyone have a hint as to why my custom policy is not being found in this situation? Do you need me to post my jboss.xml, ejb-jar.xml or login-config.xml? I have migrated from JBoss 3.2.0 to JBoss 5.0 and this is the only stumbling block I have ran into.