The idea of access control is not a new one in computer security. For decades, researchers have built on the fundamental concept of grouping and permissions. To make this less esoteric, consider that the familiar JDK 1.0.2 Java sandbox is a primitive kind of access control. So what we're talking about here is a way of setting up logical groupings. Then we can start talking about separating groups from each other and granting groups particular permissions.
Security is all about separation.
Readers familiar with the Unix or NT file system will see clear similarities to the notion of user IDs and file permissions. In this case, Java system libraries need some way of distinguishing between calls originating in untrusted code and calls originating from the trusted application itself. Clearly, the calls originating in untrusted code need to be restricted to prevent hostile activities. Java implements such a system by allowing security-checking code to examine the runtime stack for frames executing untrusted code. Security decisions can be made with reference to this check.