In 5.4. Write a Java Security Manager Policy is section Permission Specific to JBoss EAP 6 which is wrong and information there are unsatisfactory to write policy file configuration. 1) There are only names of permissions, but every permission needs to have defined type too. Without this knowledge of type this permission can't be used in policy file. 2) Names of permissions are outdated (probably from EAP5) and need to be renewed. These permissions come from different modules and for that reason every owner of module must specify, which permissions are needed for access to specific parts of his module.