Examining the J2EE Policy Agent and Installing It on Oracle
Application Server 10g. Learn the components and capabilities of
the J2EE Policy Agent, which protects hosted applications, platform
free. This paper also shows you how to install and configure the
Policy Agent on Oracle Application Server 10g.

Check it out here:
http://developers.sun.com/prodtech/identserver/ref
erence/techart/j2eepolicyagent.html?ssobm=yg