This method exposes/leaks the `privileges` array, allowing callers to modify the list. This method should return a defensive copy. And, if this class uses a list, then this method should just use `List.toArray(...)`.