Some quick background on my problem: I’m writing a compiler that converts Domain Type Enforcement specs into Java Security Manager code. In a nutshell, DTE defines “types” (objects), assigns paths to those types; then defines “domains” (subjects), and defines what permissions (rwxdc) domains have to various types. I need to emulate this behavior as closely as possible in the JSM.