Following on from JEP 486 (Permanently Disable the Security Manager), there are Permission classes which are unused. These should be deprecated, for removal in future.

In java.management, they are:

src/java.management/share/classes/java/lang/management/ManagementPermission.java
src/java.management/share/classes/javax/management/MBeanPermission.java
src/java.management/share/classes/javax/management/MBeanTrustPermission.java
src/java.management/share/classes/javax/management/remote/SubjectDelegationPermission.java
src/java.management/share/classes/javax/management/MBeanServerPermission.java