How are Java EE 5 security permissions assigned to actual users in WebSphere Application Server?

A.
By mapping application roles to users or groups within the WebSphere user registry.

B.
By generating the users in application.xml which will be created in the registry during deploy time.

C.
By the WebSphere Application Server itself, automatically, by introspecting the classes in the application.

D.
By creating the users in the application itself which will be created in the registry during deploy time.