who is responsible to define role-link

[mark ken]

please read following code, it say that deployer add role-link in ejb-jar file. But in my book, it say that assembler should define role-link.
which one is right? thank you.
<enterprise-beans>
<session>
<ejb-name>BonusCalc</ejb-name>
...
<security-role-ref>
<description>system admins have higher bonus rates.</description>
<role-name>admin</role-name> <-- This is given by the bean provider.
<!-- deployer adds the following line because she knows that the role name of system administrators is configured in her system as 'sysadmin';
<role-link>sysadmin</role-link>
</security-role-ref>
</session>
...
</enterprise-beans>

[vasu venki]

It should be application assembler.