15. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method for merging security constraints associated with an application when using security annotations, the method comprising: during application deployment, generating a list of role names; during application runtime, retrieving security constraints for the application from a plurality of sources, the sources including dynamic and static security annotations, and a deployment descriptor; and using the list of role names and the security constraints retrieved from the plurality of sources to generate a set of merged security constraints having an order of precedence.
17. The computer program product as described in claim 15 wherein the static security annotation is an @RoleAllowed static security annotation.