When the Spring integration is enabled, the TCCL that's set at the time the user endpoint methods are executed is an instance of DelegateClassLoader whose parent actually grants user visibility over classes he should only be given access if he declared a proper module dependency.