Calls to AccessControl.checkPermission() should be done by the Security Manager so that policies can be centrally managed. See this guide as a reference:

Note that the method AccessController.checkPermission is normally invoked indirectly through invocations of specific SecurityManager methods that begin with the word check such as checkConnect or through the method SecurityManager.checkPermission. Normally, these checks only occur if a SecurityManager has been installed; code checked by the AccessController.checkPermission method first checks if the method System.getSecurityManager returns null.

https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html

Also refer to fixed issue WFCORE-1266, as it is similar.