code: protected Boolean determineAccessOnElement(ActionBean bean, Method handler, AnnotatedElement element)
  	{
  		// Default decision: none.
  
  		Boolean allowed = null;
  
  		if (element.isAnnotationPresent(DenyAll.class))
  		{
  			// The element denies access.
  
  			allowed = false;
  		}
  		else if (element.isAnnotationPresent(PermitAll.class))
  		{
  			// The element allows access to all security roles (i.e. any authenticated user).
  
  			allowed = isUserAuthenticated(bean, handler);
  		}
  		else
  		{
  			RolesAllowed rolesAllowed = element.getAnnotation(RolesAllowed.class);
  			if (rolesAllowed != null)
  			{
  				// Still need to check if the users is authorized
  				allowed = isUserAuthenticated(bean, handler);
  
  				if (allowed == null || allowed.booleanValue()) {
  					
  					// The element allows access if the user has one of the specified roles.
  					allowed = false;
  					for (String role : rolesAllowed.value())
  					{
  						Boolean hasRole = hasRole(bean, handler, role);
  						if (hasRole != null && hasRole)
  						{
  							allowed = true;
  							break;
  						}
  					}
  				}
  			}
  		}
  		return allowed;
  	}
docs: Decide if the annotated element allows access to the current user.
  
  @param bean    the action bean; used for security decisions
  @param handler the event handler; used for security decisions
  @param element the element to check authorization for
  @return {@link Boolean#TRUE TRUE} if access is allowed, {@link Boolean#FALSE FALSE} if access is denied, and {@code null} if undecided
  @see DenyAll
  @see PermitAll
  @see RolesAllowed