EJBs are not allowed to open a socket to connect to a FTP server and download a document.

EJBs are not allowed to log an error to a file on disk.

EJBs are allowed to install a new security manager when they have to perform highly secure jobs.

EJBs are allowed to invoke Class.getResource in order to retrieve bundled resources (images, texts, properties, etc).

EJBs are allowed to create small java.awt.Window components in order to display business processing errors or exception messages.

EJBs are allowed to spawn their own threads in order to perform some time-consuming tasks, for example.