In order for WildFly to wrap “SE bootstrap” to run completely as trusted, WildFly would need to register a (probably via yet another service that we would need to add) callback with Hibernate ORM, that is called before/after each of the bootstrap APIs. This would avoid the permission check failures during “SE bootstrapping” but is that worth the effort?