There is no public official way to retrieve the
ProtectionDomain stack from an AccessControlContext.
There should be a method on AccessControlContext
to retrieve the stack, and this method should be
security-checked.

The ProtectionDomain information is extremely useful for
standard extensions which attempt to augment the JDK security
model with enhanced semantics.

An immediate user of this information would be the
Java Authentication and Authorization Service (JAAS).