code: @Override
      public boolean hasAccessToWebResource(String resource, String... methods) {
  
          String appName = getApplicationName();
          SecurityMetadata securityMetadata = WebConfigUtils.getSecurityMetadata();
          SecurityConstraintCollection collection = null;
          if (securityMetadata != null) {
              collection = securityMetadata.getSecurityConstraintCollection();
          }
          if (null != collection) {
  
              AuthorizationService authService = SecurityContextHelper.getAuthorizationService();
              Subject callerSubject = getCallerSubject();
  
              List<MatchResponse> matchResponses = collection.getMatchResponses(resource, methods);
  
              for (MatchResponse response : matchResponses) {
  
                  if (response.equals(MatchResponse.NO_MATCH_RESPONSE)) {
                      // There are no constraints so user has access
                      return true;
                  }
  
                  if (response.isAccessPrecluded()) {
                      //This methods access is precluded proceed to next method
                      continue;
                  }
  
                  List<String> roles = response.getRoles();
  
                  if (roles != null && !roles.isEmpty()) {
                      if (authService.isAuthorized(appName, roles, callerSubject)) {
                          return true;
                      }
                  } else {
                      // there are no roles and access is not precluded the user has access
                      return true;
                  }
              }
          }
          return false;
      }
docs: /*
  (non-Javadoc)
  
  @see javax.security.enterprise.SecurityContext#hasAccessToWebResource(java.lang.String, java.lang.String[])