15. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method for merging security constraints associated with an application when using security annotations, the method comprising: during application deployment, generating a list of role names; during application runtime, retrieving security constraints for the application from a plurality of sources, the sources including dynamic and static security annotations, and a deployment descriptor; and using the list of role names and the security constraints retrieved from the plurality of sources to generate a set of merged security constraints having an order of precedence.
19. The computer program product as described in claim 15 wherein the security constraints in the deployment descriptor are XML declared by an application developer.