 The JVM makes the system calls on behalf of the Java application.This setup allows users to decide the appropriate protection level, depending on an ACL.For example, disk and network access is usually enabled for desktop applications, but not for browser-based applets.