Since java.util.concurrent.AtomicReference was changed to use a VarHandle internally, using it early during bootstrap can lead to hard
to diagnose bootstrap cycles (since VarHandles has to do doPrivileged calls during setup), and as of 9 incurs a small startup overhead for any application run with a security manager.

The use of AtomicReference in java.security.Policy is not really motivated, though, since only the .get/.set methods are used, thus a rather straight-forward fix is to convert the code to use a volatile reference instead.