Enthuware

In the explanation, it says the bean provider may also specify method permission.

I want to add one note:

According the JSR 318 p 495, "The bean provider or application assembler defines method permissions relation in the deployment descriptor using the method-permission elements".

So, if the question asks who define method permissions, I would say bean provider or application assembler.
Bean providers use annotations such as @DenyAll, @RolesAllowed or @PermitAll.
Application assemblers or bean provider can use deployment descriptor to define method permissions.

Good point.