AFAICT there is no reason for org.apache.activemq.artemis to have a dep on org.jboss.as.security (the legacy security subsystem extension module). It doesn't implement any interfaces that Artemis loads via ServiceLoader and I see no signs of the subsystem passing in class names for Artemis to use via reflection.