An observer method may also be a non-abstract method of an EJB session bean class. It must be either a business method exposed by a local business interface of the EJB or a static method of the bean class.
If a non-static method of a session bean class has a parameter annotated @Observes or @ObservesAsync, and the method is not a business method exposed by a local business interface of the EJB, the container automatically detects the problem and treats it as a definition error.
When running in Jakarta EE, the container must extend the rules defined in [observer_method_invocation_context] and must also ensure that all kinds of observers are called in the same client security context as the invocation of Event.fire() or Event.fireAsync().
The transaction and security contexts for a business method exposed by a local business interface of an EJB session bean also depend upon the transaction attribute and @RunAs descriptor, if any.