I'm not too sure honestly. IIRC it has to do with the call stack and since it's coming from a deployment class loader I haven't found a place where permissions could/would be added. Though that is something I'd like to explore as Hibernate is definitely not the only project with this same issue.