Here's a scenario.. I have the following interface:

===============================

package com.mypublicpackage;

public interface MyInterface {
    public void foo();
}

===============================

and the following class:

===============================

package com.myprivatepackage;

public class MyClass implements com.mypublicpackage.MyInterface {
   public void foo() {}
   public void bar() {}
}

===============================

I have a method in another class that returns a reference to
MyInterface, eg:

package com.mypublicpackage;

public class MyImplementation {
   public MyInterface getMyInterface() { return new
com.myprivatepackage.MyClass(); }
}

I want to protect applications (loaded with my class loader) from
accessing anything directly in com.myprivatepackage. So if I call
MyImplementation.getMyInterface() then I should NOT be able to cast
MyInterface to MyClass or use reflection to call MyClass.bar() without
getting an AccessControlException etc.

I have my own SecurityManager and Policy implementation so is it just a
question of adding "com.myprivatepackage." to the package.access line
in java.security or is there more to it than that?

Thanks,

Stu