Yes it is true that the "beanness" for SFSB method afterCompletion(boolean) contradicts my understanding that access to resource managers/other enterprise beans requires either a meaningful transaction context or a security client context for the method.(EJB2.0 spec, p:80).
afterCompletion(boolean) method runs in an unspecified transaction context(p:76, sec7.5.7) and seems to have a valid security client context, but still access to resource managers/other beans is denied in this method unlike ejbCreate(), ejbRemove(), ejbActivate() and ejbPassivate() methods of SFSB.
This makes me believe that my understanding is not fully correct.
afterCompletion(boolean) method seems like an odd case.
I guess accessing a resource manager or an enterprise bean in a method is more dependent on the existence of transaction context rather than a security context. Since ejbCreate(), ejbRemove(), ejbActivate(), ejbPassivate() execute in an unspecified transaction context, the Container is free to spawn a single transaction/multiple transaction(s) in the methods, quite transparent to the bean-provider with enough flexiblity provided by the specs in this regard.
Coming to SFSB's afterComletion(boolean) method, a CMT transaction(Required, RequiresNew, Mandatory) would have been created and already committed or rolled back for the business method(s) by the time, this method is called by the container. So the container may not spawn another transaction to support access to other resource managers/beans in this method. If it does, accounting for the failure of this transaction becomes difficult or rather confusing to the client.
This is my theory and could totally be wrong also.
I couldn't find much information in the specs, RMH or Ed Roman's book about the afterCompletion() method's behaviour. From Kathy's book, I found the foll. stmt in p:512, chapter 9. "SessionSynchronization special moments." The right-hand side column talks about the afterCompletion() method's behaviour.
Call methods on your SessionContext: get your home, EJBObject, get caller security info. You can't do any transaction-related things because you're no longer in a transaction!. You can access ONLY your special JNDI context. It's not safe to access resource managers or other beans.
I have been following most of the posts since last Nov and I don't remember having discussed this contradictory behaviour before. I searched for old posts with words "afterCompletion" and "SessionSynchronization" and the closest, I got was the foll. post in which Kathy had a typo mistake.
https://coderanch.com/t/157623/java-EJB-SCBCD/certification/accessing-EJB A lot of people follow the stereo-type approach, memorize these things without questioning to pass the exam, that includes me also to some extent.

Thanks Ramakrisha/Joyce. You have raised a good question. I think you are making the right efforts in getting your
EJB basics right.
I look forward to Bert or Kathy to clarify the "bean-ness" of SFSB for afterCompletion method and also clarification of the spec statment on p:81,
sec 7.6.1,
Accessing resource managers and enterprise beans is disallowed in the session bean methods for which the Container does not have a meaningful transaction context or client security context.