diff --git a/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java b/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java
index 0409625d..0c0d23ed 100644
--- a/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java
+++ b/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java
@@ -118,7 +118,7 @@ public class SecurityRule {
 	 * @return true if authorized
 	 */
 	private boolean isAuthorizedAll(Collection principalAuthorities) {
-		return getRequiredAuthorities().containsAll(principalAuthorities);
+		return principalAuthorities.containsAll(getRequiredAuthorities());
 	}
 
 	/**
diff --git a/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java b/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java
index b1663f58..83a0c008 100644
--- a/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java
+++ b/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java
@@ -81,6 +81,7 @@ public class SecurityRuleTests extends TestCase {
 		Collection principalAuthorities = new HashSet();
 		principalAuthorities.add("ROLE_USER");
 		principalAuthorities.add("ROLE_SUPERVISOR");
+		principalAuthorities.add("ROLE_NEVERTOBEHAD");
 		return principalAuthorities;
 	}
 }