The java.policy files configuration should ideally be modularized. For example, each module source
directory should contain a java.policy file (ex: src/$MODULE/${share,OS}/conf/security/java.policy) which
grants the permissions required by that module. A module on the bootclasspath or a module that did 
not require any additional permissions would not have a java.policy file.

At build/link time, these java.policy files are concatenated together to produce the complete java.policy file. 

This would also enable an image to have a java.policy file configured with the modules linked
in the image rather than containing entries for non-existent modules.