An authorization rule that determines who is permitted to execute one or more enterprise bean methods.