I was unable to determine why the default jboss configuration contains security domains jboss-web-policy and jboss-ejb-policy. It seems to me that they were used in jboss-6.0 days, but now this is no longer the case. It so, It think I'd be a good idea to remove them, as they only cause confusion to people who configure authorization for EJBs.