In AccessController.createWrapper():

            ProtectionDomain nullPD = new ProtectionDomain(null, null);
            return new AccessControlContext(new ProtectionDomain[] { nullPD });

an extra ProtectionDomain object is created each time (if the isAuthorized check fails), which could cause some overhead. Instead nullPD should be declared as a static final and reused, and any extras will get removed when the ACC is optimized.