...
This noncompliant code example shows a snippet of a custom class loader that derives from URLClassLoader. It overrides the getPermissions method and thus avoids the use of the default (more restrictive) getPermissions method defined in the Policy class. Note that the superclass's getPermissions() method calls the Policy class. Moreover's getPermission() method which by default, uses the system policy file to enforce access control. Therefore, a class defined using this the custom class loader will have permissions that are completely independent of those specified in the system-wide policy file and will override them.
...