Because a Subject can be authenticated after an application starts, there must be a way to dynamically bind the Subject to the access control context to create a single context that contains the code authority (where it was loaded from and who signed it) as well as the user authority (the Subject). For this, we use the method Object doAs(Subject subject, PrivilegedAction action). This doAs method calls a class specially designed for authorization, which implements the PrivilegedAction interface.

Another call that can be used to specify an access control context, instead of using the thread's current one, is the method Object doAsPrivileged(Subject, PrivilegedAction action, AccessControlContext acc). A special use of this is to set the AccessControlContext to null, which short-circuits the call stack at the point where the doAsPrivileged call occurs, allowing an increase in the authority while in the PrivilegedAction object. The authority will be later reduced when the object returns to the caller. Both techniques are illustrated later in this tutorial.

Both the doAs and doAsPrivileged methods come in forms that allow a PrivilegedActionException to be thrown.