It always depends on what kind of security policy you are going to use with a SecurityManager. Since Alfresco is using a collection of 3rd party open source / industry Standard libraries you would have to deal with all their specific approaches to providing their functionality. From reflection to creating custom threads (instead of e.g. using container provided executors), arbitrary file system accesses and sub-process initiation, there are quite a lot of permission you would have to grant to various libraries. AFAIK there is no comprehensive example policy file provided anywhere that you could use as a starting point.
