A protection domain is an administrative scoping construct for establishing system and service security policies. The Java 1.2 security architecture provides support for protection domains and domain based access control. Currently, the creation of domains is based on a CodeSource indicating a URL and code signers. SDM extends this framework to include explicit support for principals.