From: <glassfish_at_javadesktop.org>
Date: Fri, 19 Sep 2008 14:19:40 PDT

please check if an unqualified grant of AllPermission is in effect for the effected domain. Such a grant will effectively disable all of the role based access checks performed by the web container. see the (end-of the following) for a more detailed explanation.

http://blogs.sun.com/monzillo/entry/policy_files_the_securitymanager_and
[Message sent by forum member 'monzillo' (monzillo)]

http://forums.java.net/jive/thread.jspa?messageID=300462