JNLP and dynamic code

Question

My applicaton runs via JWS and JNLP. The app relies on Groovy (groovy.codehaus.com) to compile and run some text-processing scripts. End-users input the scripts themselves. When the app invokes a script, the JVM throws an access denied exception for java.lang.RuntimePermission accessDeclaredMembers.
Our jars are signed by a single authority. The JWS docs seem to indicate that since the jars are signed, our code should run trusted and thus have AllPermissions. Does AllPermissions not include the accessDeclaredMembers RuntimePermission? All other permissions seem to be allowed (read/write local files, access protected system properties, etc.).
Details: Groovy is a tool for compiling scripts into Java bytecode. This results in a class file which Groovy's script processor dynamically loads via the ClassLoader. The exception occurs as Groovy is using reflection to get the new class' constructor. Here's the stack trace:
Script Error: access denied (java.lang.RuntimePermission accessDeclaredMembers)
java.security.AccessControlException: access denied (java.lang.RuntimePermission accessDeclaredMembers)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkMemberAccess(Unknown Source)
at java.lang.Class.checkMemberAccess(Unknown Source)
at java.lang.Class.getDeclaredConstructors(Unknown Source)
at groovy.lang.MetaClass.<init>(MetaClass.java:141)
at groovy.lang.MetaClassRegistry.getMetaClass(MetaClassRegistry.java:120)
at org.codehaus.groovy.runtime.Invoker.getMetaClass(Invoker.java:99)
at org.codehaus.groovy.runtime.InvokerHelper.getMetaClass(InvokerHelper.java:94)
at groovy.lang.GroovyObjectSupport.<init>(GroovyObjectSupport.java:61)

Answer 1

I have more information. I've tried running the application locally (outside Web Start) with the security manager installed (using -Djava.security.manager and -Djava.security.policy VM args).
After much trial and error, I've found that I can run the entire application (including the script processor) with the following security policies (this is on Linux):
grant codeBase "file:/my/appdir/-" {
permission java.security.AllPermission;
permission java.util.PropertyPermission "*", "read,write";
permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete";
permission java.net.SocketPermission "*:5432", "connect";
permission java.lang.RuntimePermission "*", "";
Notice I didn't have to add anything special to get Groovy to run. Since the JWS dev guide says that a signed application has AllPermission by default, I think what's happening is that the codebase I'm using to run the Groovy script does not match the codebase in JWS' security policy for my application.
Is there any way I can find out what this codebase is? Or does anyone have any other ideas on how to solve this?