Here you can get a PrincipalFacade which limits MyPrincipal to getName() only, this is perfectly valid per spec.Nope, I spec'ed this such that securityContext.getCallerPrincipal() MUST return the *exact* principal type that was set by the authentication mechanism. Yep and my statement is still true. You can still wrap the context in a filter and break that so a user can't rely on it.