Is "run-as" a must for MDB?

[Alec Lee]

Is "run-as" a must for MDB? HFEJB says it *can* (which implies optional), but I think I *must*; otherwise, the bean called by MDB dont know what security context to use.

[Pradeep Dhavakumar]

Can or must depends on what the "other" bean is .If the other bean is also a MBD or has methods NOT dependent on the the client's role it is "can".