I am looking at the code in org.jboss.system.server.security.SecurityPolicy -- it looks like the setters setSecurityManager(), setPolicyURL(), have no callers! My problem is that when I run JBoss, Globals.IS_SECURITY_ENABLED is initialized to false, because at the moment of initialization, the SecurityManager is null. How does this work?