from the documentation:
More information about discovery mode is in the ALES 3.0 documentation
The ASI Authorization and ASI Role Mapping providers support a Discovery mode that helps make this task easier. Typically, these providers answer questions about security, but when in Discovery mode, the providers record information about those questions to build your policy (for example, what privileges and resources must be granted to view a particular web page).
To use Discovery mode, you must modify the command line that starts your Security Service Module by adding the following system properties:com.bea.security.providers.authorization.asi.AuthorizationProviderImpl.discoverymode=true