What else must the developer do to ensure that the intended security goal is achieved（）？  

A、 Create a user called vip in the security realm

B、 Define a group within the security realm and call it vip

C、 Define a security-role named vip in the development descriptor

D、 Declare a security-role-ref for vip in the deployment descriptor