We have methods such as the following where a permission check occurs but the Javadoc does not describe the required permission so an end user would only discover this by trial and error.

http://wildfly-security.github.io/wildfly-elytron/1.3.x/api-javadoc/index.html?org/wildfly/security/auth/server/SecurityIdentity.html