Look at the descriptions for the methods 'equals' and 'hashCode' of class javax.security.auth.Subject

==== hashCode ====
Throws:
    SecurityException - if the caller does not have permission to access this Subject's private credentials.
==================

==== equals ====
Throws:
    SecurityException - if the caller does not have permission to access the private credentials for this Subject, or if the caller does not have permission to access the private credentials for the provided Subject.
=================

Both description says nothing about required set of permissions which must be granted to have access to the private credentials. If it's specified somewhere in another place it would be better to provide the link to that description.