The new Policy.getPermissions(ProtectionDomain) method maintains a cache, which is good. However, Policy.refresh() was left as abstract. Given that subclasses of Policy might decide to call super.getPermissions(PD) to take advantage of that cache (in addition to whatever else they do), subclasses should also be able to call super.refresh() to clear that cache.