code: private boolean parseClassSecurity(Class<?> cls, SecurityContext sc) {
  
          // try DenyAll
          DenyAll denyAll = cls.getAnnotation(DenyAll.class);
          if (denyAll != null) {
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                  Tr.debug(tc, "Found class level @DenyAll - authorization denied for " + cls.getName());
              }
              return false;
          } else { // try RolesAllowed
  
              RolesAllowed rolesAllowed = cls.getAnnotation(RolesAllowed.class);
              if (rolesAllowed != null) {
  
                  String[] theseroles = rolesAllowed.value();
                  if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                      Tr.debug(
                               tc,
                               "found RolesAllowed in class level: {} "
                                   + cls.getName(),
                               new Object[] { theseroles });
                  }
                  if (!ensureAuthentication(sc)) {
                      return false;
                  }
                  if (!isUserInRole(sc, Arrays.asList(theseroles), false)) {
                      return false;
                  }
                  return true;
              } else { // try PermitAll
  //				PermitAll permitAll = cls.getAnnotation(PermitAll.class);
                  return true;
              }
  
          }
  
      }
docs: parse security JSR250 annotations at the class level