How are application security definitions handled when the application is deployed into a production

Hi.

I'm investigating the deployment of an ADF developed application onto a WebLogic 10.3.6 managed server. The application comes with a jazn-data.xml file with security definitions in it. When deployed in development the WL system-jazn-data.xml file in config/fmwconfig gets automatically updated however |'ve been led to believe this doesn't happen when the server is in production mode, so you have to update the security definitions manually i.e. by running a WLST script. I'm very new to this and can't seem to find any documentation around how to do this. I've raised a service request but thought I would try here as well. Bsically