Security, Transaction services and lifecycle are service of EJB or Container. What is of EJB and what is of Container ?
I would almost say that all of these are "of" the container. - Security is enforced (declarative) and enabled (for programmatic security) by the container, which implements the necessary interfaces and contracts defined in the EJB specification. - Transaction services are implemented by the container, although part of the actual transaction management might be incorporated into the supporting EJB classes generated by the container. - Lifecycle management is also handled by the container as the EJBs live and die under the strict control of the container. Hope this helps.