Hmm... tricky...
EJB 2.0 spec, page 413:
If the Bean Provider provides a value for an environment entry using the env-entry-value element, the value can be changed later by the Application Assembler or Deployer.
The deployment descriptor is a deliverable of the Bean Provider, and may be edited by the Application Assembler (spec page 458-9). The Deployer, however, reads the DD into the environment, and may edit the values in the environment, but he does not edit the DD file itself.
Page 415:
The Deployer can modify the values of the environment entries that have been previously set by the Bean Provider and/or Application Assembler, and must set the values of those environment entries for which no value has been specified.
In real life, the Deployer (or rather, the person who deploys) does edit the deployment descriptor - but in doing so he actually plays the part of the Application Assembler.