The Java EE 7 Tutorial
Concurrency Utilities for Java EE defers most security decisions to the application server implementation. If, however, the container supports a security context, that context can be propagated to the thread of execution. The
ContextService can support several runtime behaviors, and the
security attribute, if enabled, will propagate the container security principal.