> The idea of having different declarative security realms is fine but it's not what the Java Security Manager is.

But.. it is?

The JVM tracks where bytecode was loaded from, and then you can define a policy to limit what that code can do.

Here's an example giving read-only access to /etc

https://access.redhat.com/documentation/en-us/red_hat_jboss_...