Runtime Access

Declare runtime access

Consistent with Integrity by Default, access that can weaken module integrity must be authorized by the consuming module. Access that cannot be expressed with standard module directives can be declared using jig runtime access attributes:

/**
 * @enableNativeAccess com.example.nativebinding
 * @enableFinalFieldMutation com.example.model
 * @addExports jdk.compiler/com.sun.tools.javac.tree=com.example.processor
 * @addOpens java.base/java.lang=com.example.framework
 */
module com.example.application {
}

Pass the corresponding runtime option to require to add the authorization with a dependency:

ja require com.example.nativebinding@1.2.3 \
  --enable-native-access com.example.nativebinding

The application or tool selected as the root must authorize all runtime access needed by its dependencies. A dependency can record the access it requires, but cannot authorize itself, and authorization is not inherited through requires directives.

Adding a dependency with require, or installing an application, requires every runtime access requirement in the resulting module graph to be satisfied. Resolution fails when the selected root does not authorize one of those requirements.

These declarations are validated and applied automatically. Installed tools carry the same settings in their runtime images, so users do not need to maintain JVM flags in wrapper scripts.