Third layer:

The third and last layer of the Java security model is the implementation of the Java class library. A Class in the library gives Java applications along with their only means of access to sensitive system resources, like as files and network connections. Those classes are written so in which they always perform security checks before granting access.

This third layer is the portion of the security system in which an application could control- not  through  changing  the  library  implementation, but  through  supplying  the  objects  which actually make the decisions about whether to grant each request for access. These objects-the security manager and the class loaders-are the core of an application's security policy, and you'll read more about them (involving how to implement them) a little later in this chapter.