The RestClientBuilderResolver does some privileged actions for various things like looking up the class loader. However, the loadSpi() uses a ServiceLoader and does not use a privileged action requiring java.io.FilePermission to be added to read the SPI JAR.