We allow people to specify the class they want to use as the policy file:

# Class to instantiate as the system Policy. This is the name of the class
# that will be used as the Policy object.
#
policy.provider=sun.security.provider.PolicyFile

But in java.security.Policy we use Class.forName:

    policy = (Policy)Class.forName(policy_class).newInstance();

Which means the policy class must be on the bootclasspath. I'm
thinking we should change that to search the system class loader, so
the policy class can also exist in an extension or on the CLASSPATH.