The concurrency requirements imposed on subclasses of PermissionCollection by the JDK security infrastructure should be specified. Can add() really be called concurrent with other methods? Do implementations really need to use Hashtable and Vector, or are HashMap and ArrayList sufficient?