What is declarative security?

Declarative security is the means of securing an application by means of deployment descriptors.
In ejb world it could be in ejb-jar.xml which is in META-INF folder. In web applications it could be in web.xml file in WEB-INF folder.