The JMX spec says (in the PDF document and in the API documentation for javax.management.MBeanServer) that permission checks are made if and only if there is a non-null SecurityManager.