Although the two preceding problems differ slightly, both share a common characteristic. They both involve making security-related decisions outside the bounds of Java's standard security machinery. In order to understand what that means, it's worth taking a few moments to learn about Java security. Let's dive in. Every method is part of a class.
Every class is associated with a protection domain.
Every protection domain is associated with a set of permissions that define the security-sensitive operations that classes in the protection domain can perform. That makes up only part of the picture. If you imagine the chain of method calls as a stack of blocks, it would look something like Figure 1, which I refer to as the execution context. Every thread has its own execution context. By examining the execution context, the AccessController class decides whether or not to allow a method to execute a piece of security-critical code.