code: private void processSecurityIdentity(BeanMetaData bmd) {
          final boolean isTraceOn = TraceComponent.isAnyTracingEnabled();
  
          if (isTraceOn && tc.isEntryEnabled()) {
              Tr.entry(tc, "processSecurityIdentity");
          }
          EnterpriseBean ejbBean = bmd.wccm.enterpriseBean;
  
          boolean runAsSet = false;
          if (ejbBean != null) {
              // get runAs identity
              SecurityIdentity secIdentity = ejbBean.getSecurityIdentity();
              if (secIdentity != null) {
                  runAsSet = true;
                  if (secIdentity.isUseCallerIdentity()) {
                      bmd.ivUseCallerIdentity = true;
                      if (isTraceOn && tc.isDebugEnabled())
                          Tr.debug(tc, "RunAs set to Caller Identity ");
                  } else {
                      bmd.ivRunAs = secIdentity.getRunAs().getRoleName();
                      if (isTraceOn && tc.isDebugEnabled())
                          Tr.debug(tc, "RunAs set to " + bmd.ivRunAs);
                  }
              } // if (secIdentity != null)
  
          } // if (ejbBean != null)
  
          //Only check for @runAs annotation if it is not set by XML.  //446358
          if (!runAsSet) {
              //check for @RunAs annotation
              RunAs runAs = bmd.enterpriseBeanClass.getAnnotation(javax.annotation.security.RunAs.class);
              if (runAs != null) {
                  bmd.ivRunAs = runAs.value();
              }
          } // if (!runAsSet)
  
          if (isTraceOn && tc.isEntryEnabled()) {
              Tr.exit(tc, "processSecurityIdentity:  useCallerIdentity = " +
                          bmd.ivUseCallerIdentity + ":  Use Role = " +
                          bmd.ivRunAs);
          }
      }
docs: Process the Security Identity for the EnterpriseBean using the
  following rules:
  1. Determine if the security-identity deployment descriptor for this
  enterprise bean contains a role or the use-caller-identity element.
  2. If no security-identity exists in XML then check for the
  RunAs annotation defined on the enterprise bean.
  3. Default behavior will be determined by the Security Component.
  
  @param bmd BeanMetaData for the specific Enterprise Bean