As of JMX 1.2, the spec makes explicit the behaviour that was formerly only implied indirectly, whereby if you invoke a method through the MBean Server on a RequiredModelMBean, and that method corresponds to a public method of the RequiredModelMBean class itself, then that is the method that should be called, rather than a method on the Managed Resource as would usually be the case. However, the Reference Implementation does this even if the method in question is not declared in the ModelMBeanInfo. That is very surprising behaviour, and potentially a security problem. Only methods in ModelMBeanInfo should be invoked.