And plausibly sandboxing, too, since the JVM used to carry a policy language with it that allowed granting access by package (or by public key, IIRC), a vestige

And plausibly sandboxing, too, since the JVM used to carry a policy language with it that allowed granting access by package (or by public key, IIRC), a vestige from its days of running in the browser. But they recently killed that whole feature due to disuse