All API calls which requires security permissions should pass through a PrivilegedAction. See also https://github.com/hibernate/hibernate-validator/tree/master/engine/src/main/java/org/hibernate/validator/internal/util/privilegedactions