diff --git a/jaxrs-tck/src/main/java/jakarta/ws/rs/tck/ee/rs/container/requestcontext/security/JAXRSClientIT.java b/jaxrs-tck/src/main/java/jakarta/ws/rs/tck/ee/rs/container/requestcontext/security/JAXRSClientIT.java
index e131e58..98ac975 100644
--- a/jaxrs-tck/src/main/java/jakarta/ws/rs/tck/ee/rs/container/requestcontext/security/JAXRSClientIT.java
+++ b/jaxrs-tck/src/main/java/jakarta/ws/rs/tck/ee/rs/container/requestcontext/security/JAXRSClientIT.java
@@ -77,10 +77,17 @@
 
     WebArchive archive = ShrinkWrap.create(WebArchive.class, "jaxrs_ee_rs_container_requestcontext_security_web.war");
     archive.addClasses(TSAppConfig.class, Resource.class, RequestFilter.class);
-//    archive.addAsWebInfResource("jakarta/ws/rs/tck/ee/rs/container/requestcontext/security/jaxrs_ee_rs_container_requestcontext_security_web.war.sun-web.xml", "sun-web.xml");
+
+//  This TCK test needs additional information about roles and principals (DIRECTOR:j2ee).
+//  In GlassFish, the following sun-web.xml descriptor can be added:
+//  archive.addAsWebInfResource("jakarta/ws/rs/tck/ee/rs/container/requestcontext/security/jaxrs_ee_rs_container_requestcontext_security_web.war.sun-web.xml", "sun-web.xml");
+
+//  Vendor implementations are encouraged to utilize Arqullian SPI (LoadableExtension, ApplicationArchiveProcessor)
+//  to extend the archive with vendor deployment descriptors as needed.
+//  For Jersey in GlassFish, this is demonstrated in the jersey-tck module of the Jakarta RESTful Web Services GitHub repository.
+
     archive.setWebXML(new StringAsset(webXml));
     return archive;
-
   }
 
   public void usersetup() {
diff --git a/jaxrs-tck/src/main/java/jakarta/ws/rs/tck/ee/rs/core/securitycontext/basic/JAXRSBasicClientIT.java b/jaxrs-tck/src/main/java/jakarta/ws/rs/tck/ee/rs/core/securitycontext/basic/JAXRSBasicClientIT.java
index ea545db..725fa31 100644
--- a/jaxrs-tck/src/main/java/jakarta/ws/rs/tck/ee/rs/core/securitycontext/basic/JAXRSBasicClientIT.java
+++ b/jaxrs-tck/src/main/java/jakarta/ws/rs/tck/ee/rs/core/securitycontext/basic/JAXRSBasicClientIT.java
@@ -78,10 +78,17 @@
       jakarta.ws.rs.tck.ee.rs.core.securitycontext.TestServlet.Security.class,
       jakarta.ws.rs.tck.ee.rs.core.securitycontext.TestServlet.Scheme.class,
       jakarta.ws.rs.tck.ee.rs.core.securitycontext.TestServlet.Role.class);
-    archive.setWebXML(new StringAsset(webXml));
-//    archive.addAsWebInfResource("jakarta/ws/rs/tck/ee/rs/core/securitycontext/basic/jaxrs_ee_core_securitycontext_basic_web.war.sun-web.xml", "sun-web.xml");
-    return archive;
 
+//  This TCK test needs additional information about roles and principals (DIRECTOR:j2ee, OTHERROLE:javajoe).
+//  In GlassFish, the following sun-web.xml descriptor can be added:
+//  archive.addAsWebInfResource("jakarta/ws/rs/tck/ee/rs/core/securitycontext/basic/jaxrs_ee_core_securitycontext_basic_web.war.sun-web.xml", "sun-web.xml");
+
+//  Vendor implementations are encouraged to utilize Arqullian SPI (LoadableExtension, ApplicationArchiveProcessor)
+//  to extend the archive with vendor deployment descriptors as needed.
+//  For Jersey in GlassFish, this is demonstrated in the jersey-tck module of the Jakarta RESTful Web Services GitHub repository.
+
+    archive.setWebXML(new StringAsset(webXml));
+    return archive;
   }
 
   /* Run test */