Is JAAS okay for client apps?

Hi,

I need to choose technology to write a permissions module for my client-server app
(Eclipse RCP + GlassFish) that allows for example blocking menu options if not permitted.
I wonder what to choose: JAAS, XACML or maby something else?
Maby these two are completely wrong way and I should consider sth completely different?
What are your impressions, advice?

Best regards,
Chris

.