From Jakarta Authorization 3.0 the Policy instance is now managed by Jakarta Authorization instead of the JVM - there can not be a Policy per contextID.

Additionally the Policy instance can be defined using a system property and loaded using the Thread's context ClassLoader.

This does theoretically mean that even if a system property is global, by loading from the deployment's ClassLoader there could be a different implementation in each deployment.

We could probably handle the loading side with lazy loading as we will be in the context of the deployment at that time but that does not help with clean up, if we add a simple ContextManager SPI within the JACC service we can hook this into the lifecycle.

In the 3.x branch this will be no-op ready for implementation to be added in 4.x, we are using this pattern so the Elytron EE version can be swapped without the core code needing to be aware of the swap.