in com.sun.deploy.config.Config.java, the initialize(0 method first calls  setPolicyFiles(), then next sets all the deployment properties as System properties.
If this were the other way around, those properties could be used in the policy files read by the setPolicyFiles(), such as:

1.) to grant all-permissions to everything in the system cache:
    grant codeBase "file:${deployment.system.cachedir}/- {
        permission java.security.AllPermission;
    };
2.) to grand file permission to all webstart apps downloaded from web-east.east:
    grant codeBase "file:${deployment.user.cachedur}/javaws/http/Dweb-east.east/P80/-" {
      permission java.io.FilePermission "<<ALL FILES>>", "read, write, delete";
    };