Inside Java™ 2 Platform Security: Architecture, API Design, and Implementation, Second Edition

7.2. Customizing Security Policy

The security policy is first processed by the Policy object and then is enforced by the SecurityManager or AccessController, so customizing any of these classes would customize the behavior of the security policy. Beginning with J2SE 1.4, security policy decisions are lazily evaluated; prior to J2SE 1.4, security policy decisions were in effect statically computed in advance of enforcement. This section provides general descriptions of the various ways the policy enforcement and decision machinery can be augmented to supply specialized behavior. We first describe the extension points of the SecurityManager and then give guidance in implementing a custom Policy provider.

7.2.1. Customizing Security Policy Enforcement ...