JMX has no security model for MBeans. You either have to secure the connector or use proprietary extensions like XMBean interceptors, and this is discussed in the admin/devl guide.
Okay thanks. Yeah, I'm looking into seeing how many connectors I can delete from our deploy directory.
It makes sense, since the only MBean with an interceptor is an XMBean.