The current SubjectDomainCombiner implementation caches the value of Policy.getPolicy at constructor time. As such, a subsequent call to Policy.setPolicy will have no effect on any existing thread that is still executing in a doAs, and no effect on any threads that caches an AccessControlContext containing a combiner and uses it later. The spec does not say this occurs.