# Security Baked Into the JVM: two Subjects, one call

DevFeed: [Security Baked Into the JVM: two Subjects, one call](<https://devfeed.tech/articles/security-baked-into-the-jvm-two-subjects-one-call-18930.md>)

Original publisher: [Read original article](<https://blog.frankel.ch/security-baked-into-jvm/3/>)

Author: Peter Firmstone

Published: 2026-08-09T00:00:00Z

Content type: article

Language: en

Sources: [Nicolas Fränkel](<https://devfeed.tech/sources/nicolas-frankel.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [SPIFFE](<https://devfeed.tech/topics/spiffe.md>), [SPIRE](<https://devfeed.tech/topics/spire.md>)

Tags: [certificates](<https://devfeed.tech/tags/certificates.md>), [dirtychai](<https://devfeed.tech/tags/dirtychai.md>), [java](<https://devfeed.tech/tags/java.md>), [jgdms](<https://devfeed.tech/tags/jgdms.md>), [jini](<https://devfeed.tech/tags/jini.md>), [jvm](<https://devfeed.tech/tags/jvm.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [microservices](<https://devfeed.tech/tags/microservices.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [permission](<https://devfeed.tech/tags/permission.md>), [process](<https://devfeed.tech/tags/process.md>), [security](<https://devfeed.tech/tags/security.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [spire](<https://devfeed.tech/tags/spire.md>), [technical](<https://devfeed.tech/tags/technical.md>)

## AI overview

This article examines identity and security in the JVM through DirtyChai. It describes separate process and user identities, including SPIFFE workload credentials delivered through SPIRE and JWT/OIDC-based user identity, and explains how these identities coexist across request dispatch and privilege boundaries.

## Source excerpt

The constraint system stops a bad call before it leaves the JVM. The Safe Codebase Audit Pipeline stops bad code before a client ever loads it. What remains is identity: who is calling, and can you verify it? Most frameworks answer with a token check at the door. A filter validates a bearer token, sets a thread-local variable, and hopes that nothing downstream forgets to look at it. DirtyChai answers differently.