[ https://issues.jboss.org/browse/AS7-6684?page=com.atlassian.jira.plugin.s... ] David Lloyd commented on AS7-6684: ---------------------------------- Using {{Policy.getPermissions()}} is not the right thing to do in this case, because it will cause the JSP class to inherit the minimal set of JDK permissions; the Policy is not used to set the permissions of deployments (they are set by a deployment processor which uses data that will be populated from the {{permissions.xml}} descriptor). The CodeSource should match the one used to create the deployment module resource loader corresponding to the JSP file, and the permission set should come from the one specified in the ModuleSpecification in the deployment processing context. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira