My opinion, from looking at the code, is that SecureAnnotationsInterceptor does not automatically pick up all the classes annotated with @Path, so you will have to register them yourself with the interceptor using SecureAnnotationsInterceptor#setSecuredObject.